Identifier Detectors for Personal, Health and Financial Data
Part of Security rules.
Personal, health, or financial identifier recognizes specific number formats, applies built-in validity checks such as checksums and issued-number ranges, and, for weaker formats, requires a nearby word such as "SSN" or "routing". It finds patterns, not people. A valid-looking number that was never issued will match, and an issued number written in an unusual way may not. It does not read images, scanned documents, or content in unsupported attachments. It is available only when your deployment administrator has opened the detector library.
One rule can watch several kinds, and the editor shows each kind's validation strength and whether Block is reasonable for it:
| Kind | Validation | Nearby word | Block |
|---|---|---|---|
| US Social Security number | Shape and issued-number ranges | Not needed for dashed or spaced numbers | Reasonable for dashed numbers |
| US taxpayer identification number (ITIN) | Shape and middle-group ranges | Not needed for dashed or spaced numbers | Reasonable |
| IBAN | Country length and mod-97 check | Not needed | Reasonable |
| UK National Insurance number | Letter and prefix rules from HMRC guidance | Not needed | Reasonable |
| Canadian Social Insurance Number | Luhn check | Needed for numbers without separators | Monitor recommended |
| Australian Tax File Number | Weighted modulus-11 check | Always needed | Monitor recommended |
| US Medicare Beneficiary Identifier | Published letter and digit positions | Not needed | Reasonable |
| US bank routing number | 3-7-1 check and Federal Reserve prefix | Always needed | Monitor recommended |
| Medical record number | Digits after a label such as MRN | The label, before the number | Monitor recommended |
| Bank account number after a label | Digits after a label such as "account number" | The label, before the number | Monitor recommended |
| Email address | Conservative address shape | Not needed | Monitor with a minimum count |
| Phone number | International numbers valid in bundled numbering-plan data; US, Canadian, UK, and Australian national formats | International: not needed. National: needed | Monitor with a minimum count |
Options:
- Sensitivity. Standard finds formatted numbers and checks for a nearby word where there is no checksum. Strict wants the printed form and a nearby word. Broad also looks for unformatted nine-digit Social Security and ITIN numbers, but only next to a word. The editor shows what each setting does for every selected kind.
- Nearby word means within about 40 characters before or after the number (before only for medical record and bank account numbers) on the normalized text. A field name beside its value, such as
"ssn": "...", counts. Required demands a word for every kind. Extra context words adds up to 20 of your own words, such as an internal field name. - Minimum matches with Count distinct values turns "any email address" into "a list of 25 email addresses".
Identifier detectors read the same normalized copy as payment card version 2, so numbers split by non-breaking spaces, zero-width characters, or written with fullwidth digits are found. For HTTP content, the existing percent-encoded, base64, and nested JSON views are read too. Not claimed: dots as separators in Social Security numbers, spelled-out digits, letter-for-digit substitution, reversed values, values split across fields, and text in images.
Findings and rule evaluations record only the detector, its version, and counts per kind. Test detector adds counts of numbers found with and without a nearby word and the reasons candidates were rejected (failed check digits, outside the valid shape or range, valid but no nearby word, or found only at another sensitivity). None of this includes the number. Email addresses and phone numbers are not tracked as model-request exposure digests because they appear in nearly every request.
If your Organization turns on Capture full evidence, the content of a matching action is stored encrypted for the evidence retention period, and for an identifier rule that content contains the identifier. Only credentials are redacted from evidence. Review who can reveal evidence before enabling identifier rules together with full evidence.
Back to Security rules.