Identifier detector
Swiss AHV number: format, validation and detection
Short answer
A Swiss AHV/AVS number has 13 digits, starts with 756 and ends in an EAN-13 check digit. Maskflare accepts it with dots, spaces, hyphens or none, and only when the check digit is right.
What it is
The AHV (French: AVS) number is the Swiss social security number. In Maskflare it sits in the Switzerland pack, and the Swiss nDSG health profile includes it.
In Maskflare this is the detector ch_ahv, labelled "Switzerland - AHV/AVS social security number", category social security number, in the Switzerland pack.
Format and layout
- 13 digits, printed 756.XXXX.XXXX.XX.
- The first three digits must be 756. Anything else is rejected before the check digit is looked at.
- Separators between the groups can be a dot, a space, a hyphen, or absent: 756.9217.0769.85 and 7569217076985 are the same number to the detector.
- The last digit is the check digit.
How the check works
The check is the EAN-13 rule. Number the first twelve digits from the left; digits in odd positions count once and digits in even positions count three times. Add them up, take the remainder after dividing by 10, and the check digit is 10 minus that remainder (0 when the remainder is 0).
A random 13-digit number that starts with 756 passes this test one time in ten, so the prefix and the check together remove most look-alikes but not all of them.
Worked example
- First twelve digits: 7 5 6 9 2 1 7 0 7 6 9 8.
- Weighted by 1, 3, 1, 3 and so on: 7, 15, 6, 27, 2, 3, 7, 0, 7, 18, 9, 24.
- The total is 125, the remainder after dividing by 10 is 5, and 10 minus 5 gives the check digit 5, the last digit of the example.
Valid and invalid examples
| Example | Result | Why |
|---|---|---|
756.9217.0769.85 | Valid | Matches the layout and passes the validator. |
756.9217.0769.80 | Invalid | The invalid example changes one character, the last character: 5 becomes 0. |
In running text the valid example reads, for instance, AHV 756.9217.0769.85. The invalid one is left alone: a value that fails the validator is treated as an ordinary string.
Regex and validation caveats
- No keyword is needed. The detector has no context words, so the shape and the check digit alone decide. A 13-digit run that starts with 756 and passes the check is masked even in a table with no label.
- A passing check shows the number is well formed, not that it was ever issued to anyone.
- Free text is matched as written. An AHV number split across a line break, or with letters between the groups, is not one match.
How to detect it in LLM traffic
Swiss AHV number values reach an LLM inside ordinary work rather than as standalone data: a pasted block of HR or payroll rows, a customer-support thread, an onboarding or identity-check form, a spreadsheet someone wants summarised, or an email they want rewritten. The model needs none of the digits for any of those jobs, so the safest place to remove them is before the request leaves the company.
Maskflare reads the whole request body, including the system prompt, earlier messages and tool arguments, so a number buried in the fourth message of a long chat is found as readily as one in the latest message. Each match is replaced with a token such as mf_mask_d7e0 before the request goes out, and with response restoration turned on the real value is put back into the answer for the person who is allowed to see it.
If you build the detection yourself
- Strip spaces, dots and hyphens before running any arithmetic, but remember where they were so the original text can be replaced exactly.
- Match the shape with a pattern anchored on word boundaries, so that a long digit string is not read as several shorter Swiss AHV number candidates.
- Run the check from the section above. A failing check is almost always a typo or a made-up value; a passing one removes most look-alikes.
- Replace the value before the text is sent anywhere, and keep a mapping if the answer has to be restored afterwards.
How Maskflare handles it
- Protect now, Finance - Protect now, Healthcare and Developer: mask (a reversible token) when Switzerland is a primary country.
- Monitor first: alert (counted, forwarded unchanged) when Switzerland is a primary country.
The available actions are mask (reversible token), redact, partial, hash, format-preserving encryption, generalize, alert and block. Masked values are kept encrypted for 30 days so that answers can be restored, then they expire; prompts and responses are not logged. The full list of detectors is in the detector reference.
Compliance profiles that include it
One compliance profile includes the Switzerland pack, and applying it turns this detector on: Switzerland - nDSG health data. A profile is a floor: it never turns anything off or weakens a rule that is already stricter.
Frequently asked questions
Does an AHV number need the word AHV next to it to be detected?
No. The Maskflare detector for it uses no context words. It matches the 756 prefix, the group layout and the check digit wherever they appear.
Is a 13-digit number starting with 756 always an AHV number?
No. About one in ten random numbers with that prefix pass the check digit. The detector cannot tell the difference, so it masks every number that passes.
Is the Swiss AHV number detector on by default?
It depends on the organisation's primary countries. It is part of the Switzerland pack, which the default Protect now template turns on with the action mask when Switzerland is a primary country.
Does a valid Swiss AHV number prove the person exists?
No. A check digit shows the value is well formed. Many valid-looking numbers have never been issued, and Maskflare masks them all the same.
Rules on this page describe what Maskflare's detectors and validators check. They are read from the detection catalogue and are not the specification of the body that issues the identifier. Examples are synthetic.