VeloPrompt 如何以校驗位驗證 7 個西班牙語國家的身份編號

People paste contracts, client lists and bank emails into ChatGPT every day. We built VeloPrompt, an open-source (MIT) browser extension that spots personal data before it reaches an AI chat and swaps it for labels like [CEDULA_1] or [IBAN_1]. The AI works with the labels; the real values come back only on your screen.
Most tools in this space are built around US and English formats. Our users are in Spain and Latin America, where the sensitive numbers are a cédula, a RUC, a DNI, a CURP or a RUT. This post is about the part that took the most care: detecting those numbers without flagging every order ID and invoice amount.

Shape is not enough

A 10-digit number can be an Ecuadorian cédula, a phone number, an order ID or a timestamp. If you match by shape alone, the extension warns on everything and people turn it off. So every rule validates the number's own check digit before it counts.

Three examples

Ecuador, cédula (modulo 10). The first two digits are the province (01-24 or 30). Multiply the first nine digits by 2,1,2,1,..., subtract 9 from any product above 9, sum them, and the check digit is (10 - sum mod 10) mod 10.
Spain, DNI/NIF (letter). The letter is "TRWAGMYFPDXBNJZSQVHLCKE"[number mod 23]. For a NIE, replace the leading X, Y or Z with 0, 1 or 2 and apply the same rule.
Chile, RUT (modulo 11). Multiply the digits from right to left by 2,3,4,5,6,7 (and repeat), take 11 - (sum mod 11); 11 means 0 and 10 means K. It has to accept both 12.345.678-5 and 12345678-5.
The same idea covers Mexico (CURP, RFC, CLABE), Colombia (NIT), Peru (RUC), Argentina (CUIT/CUIL, CBU), Spanish CIF and IBANs (mod 97), plus cards with Luhn.

When there is no check digit

A Peruvian DNI or a Colombian cédula has no checksum. For those, the number only counts if a context word is nearby ("DNI", "C.C.", "cédula"). And a valid-looking number is still ignored if it follows words like "pedido", "factura" or "seguimiento", or looks like an amount.
When two rules match the same number (a Peruvian RUC and an Argentine CUIT that both start with 20 share the same arithmetic), the one with context wins. Either way the value gets masked; only the label can differ.

Testing without real people

The test suite never uses real documents. A separate generator builds valid numbers with its own implementation of each algorithm, so the tests do not validate the code against itself. Each rule is tested with valid numbers, numbers with a wrong check digit (which must not match) and look-alikes such as order IDs and dates. detect() runs on 50,000 characters in about 3 ms.

Everything stays local

The engine (veloprompt-core) is plain TypeScript with no runtime dependencies. The extension makes no network requests, and the label-to-value map lives only in the tab's memory.
Each country is one rules file with its tests, so adding a country is a small, self-contained pull request. If you work with IDs from a country we do not cover yet, we would love the contribution: github.com/zaisor-technology/veloprompt
What do you do today to keep personal data out of AI chats?