Sporlockby Tielemans Software

Free CPR check · No upload

Find CPR numbers in your files before someone else does.

Drop in a spreadsheet, an export or a list. In seconds you see whether it hides Danish CPR numbers, and where.

Your file stays in your browser.

The file is read and checked locally in your browser. The page contains no code that uploads it, and the browser's security policy blocks the page's scripts from contacting other servers (fetch, XHR, WebSocket and forms). You can verify this yourself. How to verify it

Drop files here

or

Word, Excel, PowerPoint, PDF, CSV, text and e-mail (.eml)

No file to hand?

Don't trust us. Check.

“We don't upload your files” is easy to write. Here are three ways to see that it's true:

  1. Wait until the page has finished loading (it fetches the PDF reader straight away too), then turn off wifi and drop in a file. The check still works, because it happens on your computer.
  2. Open your browser's developer tools (F12), pick the Network tab and reload the page. You only see requests to cpr.tielemans.dev: the page, its scripts, styles, icon and the PDF reader. Then run a check: no new requests appear.
  3. Read the page's Content Security Policy on the right. connect-src 'none' forbids the page's scripts from sending anything with fetch, XHR or WebSocket (not even to us), form-action 'none' forbids forms, and everything else (scripts, styles, images) may only be loaded from the page's own address ('self'). One thing the policy doesn't cover: the page navigating to another address. Our code doesn't, and it would show in the Network tab.

We store nothing: no cookies, no local storage, no logging of file names or contents. Privacy policy

The policy the server sends with every page:

default-src 'none';
script-src 'self';
style-src 'self';
img-src 'self';
font-src 'self';
connect-src 'none';
form-action 'none';
base-uri 'none';
manifest-src 'self';
frame-ancestors 'none'

What the check looks for

A CPR number is ten digits, but not every ten digits are a CPR number. So we weigh every hit.

  1. Format and date

    DDMMYY-XXXX, with or without a dash. The first six digits must be a real date, with the century taken from the 7th digit as the CPR Office describes it.

  2. Context

    “CPR” or “personnummer” nearby or in the column header raises confidence. Words like “phone” and “invoice” lower it.

  3. Excel's lost zero

    In a number-formatted column, Excel stores 0101901234 as 101901234. We find those too when the column looks like a CPR column.

  4. Masked output

    You only see the birth date and stars (150385-****). The full number is never shown and never stored.

For companies on Microsoft 365

One file is a spot check. SharePoint is the whole archive.

Payroll lists from 2019, member lists, applications and accounting exports often still sit in SharePoint and OneDrive, shared by a link nobody remembers. Microsoft 365 Business Basic and Standard don't include Purview DLP, which can find CPR numbers. Only the pricier plans do.

Sporlock for Microsoft 365 is in development. Sign up and we'll contact you when your company can try it.

The Microsoft 365 version

DKK 19 per user per month, ex. VAT

Or DKK 190 per user per year (2 months free).

The first scan is free and shows what it found and what it couldn't read. You pay only when you want to fix things.

  • Scans SharePoint and OneDrive in your tenant and tells you how many files it read, skipped or couldn't open
  • Shows who can open the files: anyone with the link, the whole organisation, or external users, and says so when it can't tell (e.g. a SharePoint group)
  • Locks sharing down in one click
  • Report for the data controller and scheduled rescans
  • Never stores file contents or CPR numbers, only counts and sharing state
Get early access

Guides on CPR numbers and GDPR

Short, practical answers with references to the law and the Danish Data Protection Agency.

Is the Danish CPR number sensitive data? CPR and GDPR

What section 11 of the Danish Data Protection Act says, and why CPR is “confidential”, not “sensitive”.

Can you send a CPR number by email?

The Danish DPA's encryption requirement, plus SMS and attachments.

CPR number sent or shared by mistake: handling the breach

The first 72 hours: stop the sharing, assess the risk, notify the DPA.

How to find CPR numbers in your files

Search Excel, Word and CSV, and why Excel stores CPR numbers without the zero and dash.

CPR numbers in SharePoint and OneDrive: GDPR in Microsoft 365

Why old sharing links are the risk, and what Business Basic and Standard lack.

Rules for storing CPR numbers

How long, where and how: data minimisation, deletion and access control.

Questions

Do you store my files or the results?
No. Your browser reads the file and it stays there. Close the tab and everything is gone. Neither the file, its name nor the results are sent to a server.
Does the check find every CPR number?
No, no tool does. The check finds numbers in readable text. It doesn't see text in images or scanned PDFs, or numbers split across cells. Conversely, a phone or order number can look like a CPR number, so we show a confidence level for each hit.
Is it illegal to have CPR numbers in files?
Not in itself. But companies need a legal basis to process CPR numbers (section 11 of the Danish Data Protection Act), must keep them secure and delete them when no longer needed. Read more
Who is behind this?
Tielemans Software, a Danish software company in Aalborg. The content on this site is general information, not legal advice. About and contact