Feature comparison
Competitor data from AWS Comprehend and Amazon Macie public documentation, 2026 — verify before relying.
| Feature | anonym.plus | AWS Comprehend / Macie |
|---|---|---|
| Data leaves your device | Never (100% on-device) | Yes — Comprehend requires sending text to AWS's API for inference, and Macie scans objects that already reside in your S3 buckets inside AWS's cloud |
| Deployment | Native desktop app (Windows, macOS, Linux) | Managed cloud services — Comprehend (API/SDK calls) and Macie (S3-integrated discovery job), both configured and run from the AWS console or CLI |
| Offline / air-gap | Yes — fully functional with Wi-Fi off, no network required | No — both require an active AWS account and a live connection to AWS endpoints; Macie also requires your data to already be sitting in S3 |
| Entity types | 340+ PII entity types detected locally | A limited, fixed catalog of built-in PII entity types, concentrated on English-language documents; Macie separately offers managed data identifiers for categories such as credentials and financial/health identifiers, plus custom regex-based identifiers — exact counts vary by AWS region and change over time, see AWS docs |
| Encryption | Local AES-256-GCM; offline vault for keys, never uploaded | Encryption at rest and in transit via AWS KMS — but the underlying text still transits AWS infrastructure for Comprehend to analyze it, and Macie's findings live alongside your S3 data in the same account |
| Account / login required | No account for core use — internet only needed once, for license activation | Yes — a funded, billed AWS account with IAM roles and service permissions configured for both Comprehend and Macie |
| Pricing model | One-time license (Free / €149 / €399 / €499) — no subscription, no metering | Usage-metered — Comprehend billed per unit of text processed, Macie billed per GB evaluated and per S3 bucket/object monitored; cost scales with data volume and scan frequency |
| Setup / DevOps | None — bundled installer (Microsoft Presidio + spaCy built in), works out of the box | Requires AWS account setup, IAM policies, and (critically) your own integration work: Comprehend only detects and flags PII, it does not redact documents by itself, and Macie only discovers/classifies sensitive data in S3 — neither ships a turnkey redaction workflow |
| Compliance angle | No document data egress by design — verifiable by running the app with the network disconnected, nothing to disclose because nothing is transmitted | Strong AWS platform certifications (SOC 1/2/3, ISO 27001, HIPAA eligibility) — but your data is processed and/or stored on AWS infrastructure as a subprocessor, so a DPA/BAA and subprocessor review are typically required |
AWS Comprehend & Macie strengths
- Comprehend is a mature, managed NLP service with both real-time (synchronous) and asynchronous batch PII-detection jobs, backed by AWS's ongoing model updates.
- Deep native integration with the rest of the AWS stack — S3, Lambda, Textract, Step Functions, EventBridge — for teams building larger automated data pipelines.
- Macie is purpose-built for a different job anonym.plus doesn't do: continuously discovering where sensitive data already lives across a large, growing S3 estate, using managed and custom data identifiers.
- Macie findings feed directly into AWS Security Hub and EventBridge, so security teams can wire discovery results into existing SOC/SIEM workflows.
- Elastic, pay-as-you-go scale-out with no local capacity planning — useful for organizations with unpredictable or bursty scanning volume.
- Enterprise support plans and compliance attestations (SOC 1/2/3, ISO 27001, HIPAA eligibility) are already in place for teams standardized on AWS.
AWS Comprehend & Macie limitations
- Both services keep your data inside AWS's cloud — Comprehend by sending text to its API, Macie by scanning data that's already stored in S3. Neither has an offline or air-gapped mode.
- Comprehend's built-in PII entity catalog is comparatively narrow and skews toward English-language text; broader coverage generally requires custom model training or supplementary tooling.
- Comprehend detects and flags PII — it doesn't redact a document for you. Turning a detection result into a redacted file means assembling your own pipeline (e.g. Textract + Comprehend + Lambda).
- Macie discovers and classifies sensitive data in S3 but does not anonymize, mask, or remove it — it's a discovery/alerting tool; remediation is left entirely to the customer.
- Usage-metered pricing on both services means cost grows with data volume and scan frequency, which can be hard to predict as an S3 estate or document volume grows.
- Requires a funded, configured AWS account (IAM roles, KMS keys, service permissions) before you can process a single document — meaningful setup even for occasional, single-user use.
- Sending sensitive data through Comprehend, or storing it in an S3 bucket Macie scans, creates an AWS subprocessor relationship that GDPR/HIPAA-sensitive organizations must document and justify.
Why choose anonym.plus
- Your data never leaves your device. There is nothing to breach, no data center, no jurisdiction to trust — because nothing is ever transmitted, and there's no AWS account, bucket, or region to worry about.
- Works with no internet connection. Disconnect the network and anonym.plus keeps running; Comprehend and Macie cannot function at all without connectivity to AWS's endpoints.
- 340+ PII entity types detected locally, built on Microsoft Presidio and spaCy — bundled, with no AWS account, IAM setup, or custom redaction pipeline required.
- Local AES-256-GCM encryption with an offline key vault — keys and documents both stay on your machine, never in a cloud KMS or S3 bucket.
- One-time license, no subscription. Internet is only needed once, for initial license activation — not for every document you process, and not metered by the gigabyte.
- Verifiable yourself. Because processing runs entirely on-device, there are zero outbound network calls during document processing — disconnect the network and anonymization still works.