Skip to main content

GDPR Art. 25 (opens in a new tab) · Banking and insurance

Regulated LLM platform

A bank or insurer that sends customer data to a large language model exposes data it is obliged to protect.

Modern Miracle built a white-label platform that splits and anonymises each query before any model call.

Engagement facts

Status
Shipped to the client in 2025 as a white-label platform.
Sector
Regulated financial services (banks and insurers)
Year
2025
Delivery
Planned and built by Modern Miracle
Form
White-label platform
Timeline
Delivered and accepted · 2025

Operating constraint

A bank or insurer adopting large language models had to keep customer data from reaching external model providers in usable form, because GDPR Art. 25 requires data protection by design. It also needed a platform that runs on public cloud and on infrastructure the client controls.

System context. The platform runs inside the client environment; only tokenised fragments reach external model providers.

Design response

Modern Miracle planned and built an orchestration layer between the client's users and the models. A privacy service detects personal data in each query and replaces it with reversible tokens whose mappings are stored encrypted, and a fragmentation service splits the query so no single model call carries the full customer context. A routing service selects the model provider for each fragment, and the answer is reassembled inside the client's environment. Document parsing and chunking prepare the client's files for retrieval, a streaming service serves the chat interface, and an API gateway applies authentication and rate limits. The client decides the purposes and essential means of processing and is the controller under GDPR.

Containers. Markers 1 to 3 show where each decision sits in the system.

Decisions, and the obligation or standard each one meets.

  1. 1. Each query is split into fragments before any call to the model.

    Fragmentation service

    Meets GDPR Art. 25(1) data protection by design. No single model call carries the full query. (opens in a new tab)

  2. 2. Identifying data is anonymised before the model call.

    Privacy service

    Meets GDPR Art. 5(1)(c) data minimisation. Sensitive customer data does not reach the model in usable form. (opens in a new tab)

  3. 3. Delivered as a white-label platform.

    Client environment boundary

    Meets GDPR Art. 4(7) and EDPB Guidelines 07/2020 define the controller as the party that decides the purposes and the essential means of processing. The client decides both, so the client is the controller. Modern Miracle's own processing under the client's instruction is governed by GDPR Art. 28 processor terms. (opens in a new tab)

Result

The client accepted the white-label platform in 2025. In the delivered design, sensitive customer data does not reach an external model in usable form, and the complete customer context stays inside the client's environment.

The record behind this engagement.

The client is not named. Architecture and delivery details are available in a diligence call.

Tell us what you're building and the regulation it has to meet.

You will speak with one of the two founders.