PII Scanning

Detect and mask personally identifiable information (PII) in request and response bodies before storage.

How It Works

PII scanning is opt-in. When enabled, the CoreValue platform scans request and response bodies for sensitive data and replaces detected values with mask tokens before storage.

Detected PII Types

• Email addresses → [EMAIL_REDACTED]
• Phone numbers → [PHONE_REDACTED]
• SSN → [SSN_REDACTED]
• API keys → [API_KEY_REDACTED]
• Credit card numbers → [CREDIT_CARD_REDACTED]
• IBAN → [IBAN_REDACTED]
• IP addresses → [IP_REDACTED]
• US passport numbers → [PASSPORT_REDACTED]

Key Properties

• Opt-in: Orgs must explicitly enable PII scanning via organization.pii_scanning_enabled
• Never blocks: PII scanning masks but does not block requests. A "block mode" is a future enhancement.
• Fails gracefully: PII scanning failures fall through — ingestion is never blocked
• Bodies only: Only request and response bodies are scanned, not headers or metadata

Enabling PII Scanning

1. Via API: POST /v1/organization/pii-config with {"patterns": ["email", "ssn", "credit_card", ...]}
2. Via Web UI: /settings/security — toggle PII scanning on/off and select patterns
3. Scanning is applied to all requests automatically once enabled

Use Case: GDPR/CCPA Compliance

Enable PII scanning alongside body retention to ensure stored data is masked:

• Body retention ON + PII scanning ON → masked bodies stored
• Body retention OFF → no bodies stored (PII scanning not needed)
• Body retention ON + PII scanning OFF → raw bodies stored (not recommended for PII-heavy workloads)