Identifier detector
Swiss UID (CHE number): format, validation and detection
Short answer
A Swiss company identification number (UID, also the MWST/TVA/IVA number) is written CHE-123.456.788: nine digits, the last a modulus 11 check digit over the first eight.
What it is
The UID identifies a business in Switzerland and doubles as the value-added tax number. Maskflare files it under tax IDs in the Switzerland pack, and the Swiss nDSG health profile includes it. It appears in invoices, contracts and onboarding forms that people paste into AI tools.
In Maskflare this is the detector ch_uid, labelled "Switzerland - Company id (UID / MWST)", category tax id, in the Switzerland pack.
Format and layout
- The letters CHE, then nine digits grouped 3.3.3: CHE-123.456.788. The pattern accepts a hyphen or space after CHE and dots or none between the groups.
- A tax suffix such as MWST, TVA or IVA may follow in documents; the detector matches the number itself.
- The ninth digit is the check digit.
How the check works
Multiply the first eight digits by 5, 4, 3, 2, 7, 6, 5 and 4, add the products and divide by 11. The check digit is 11 minus the remainder, with 11 counted as 0. A result of 10 is never issued, so a number that would need check digit 10 is rejected.
Worked example
- Digits 1 2 3 4 5 6 7 8 with weights 5 4 3 2 7 6 5 4 give 5, 8, 9, 8, 35, 36, 35, 32.
- The total is 168, and 168 divided by 11 leaves 3.
- 11 minus 3 is 8, the last digit of the example.
Valid and invalid examples
| Example | Result | Why |
|---|---|---|
CHE-123.456.788 | Valid | Matches the layout and passes the validator. |
CHE-123.456.780 | Invalid | The invalid example changes one character, the last character: 8 becomes 0. |
In running text the valid example reads, for instance, UID CHE-123.456.788. The invalid one is left alone: a value that fails the validator is treated as an ordinary string.
Regex and validation caveats
- The detector has no context words, so a CHE-shaped number is masked anywhere, with or without the words UID or MWST.
- A UID names a business rather than a person, so some teams will not want it masked. The rule can be switched off or set to alert in the console.
- The check says the number is well formed, not that a business is registered under it.
How to detect it in LLM traffic
Swiss UID (CHE number) values reach an LLM inside ordinary work rather than as standalone data: a pasted block of HR or payroll rows, a customer-support thread, an onboarding or identity-check form, a spreadsheet someone wants summarised, or an email they want rewritten. The model needs none of the digits for any of those jobs, so the safest place to remove them is before the request leaves the company.
Maskflare reads the whole request body, including the system prompt, earlier messages and tool arguments, so a number buried in the fourth message of a long chat is found as readily as one in the latest message. Each match is replaced with a token such as mf_mask_d7e0 before the request goes out, and with response restoration turned on the real value is put back into the answer for the person who is allowed to see it.
If you build the detection yourself
- Strip spaces, dots and hyphens before running any arithmetic, but remember where they were so the original text can be replaced exactly.
- Match the shape with a pattern anchored on word boundaries, so that a long digit string is not read as several shorter Swiss UID (CHE number) candidates.
- Run the check from the section above. A failing check is almost always a typo or a made-up value; a passing one removes most look-alikes.
- Replace the value before the text is sent anywhere, and keep a mapping if the answer has to be restored afterwards.
How Maskflare handles it
- Protect now, Finance - Protect now, Healthcare and Developer: mask (a reversible token) when Switzerland is a primary country.
- Monitor first: alert (counted, forwarded unchanged) when Switzerland is a primary country.
The available actions are mask (reversible token), redact, partial, hash, format-preserving encryption, generalize, alert and block. Masked values are kept encrypted for 30 days so that answers can be restored, then they expire; prompts and responses are not logged. The full list of detectors is in the detector reference.
Compliance profiles that include it
One compliance profile includes the Switzerland pack, and applying it turns this detector on: Switzerland - nDSG health data. A profile is a floor: it never turns anything off or weakens a rule that is already stricter.
Frequently asked questions
Is the Swiss VAT number the same as the UID?
In Maskflare's catalogue the same detector covers both, because the validator describes the UID, which is also used as the MWST/TVA/IVA number.
Why was my CHE number not masked?
Most often the check digit does not match, which happens with typos and made-up test numbers. Maskflare masks only numbers that pass the modulus 11 check.
Is the Swiss UID (CHE number) detector on by default?
It depends on the organisation's primary countries. It is part of the Switzerland pack, which the default Protect now template turns on with the action mask when Switzerland is a primary country.
Does a valid Swiss UID (CHE number) prove the person exists?
No. A check digit shows the value is well formed. Many valid-looking numbers have never been issued, and Maskflare masks them all the same.
Rules on this page describe what Maskflare's detectors and validators check. They are read from the detection catalogue and are not the specification of the body that issues the identifier. Examples are synthetic.