PII Scrubber

Personal data that reaches logs, analytics, prompts, or exports is a liability that outlives the feature that leaked it - retention systems copy it, backups preserve it, and deletion requests cannot find it. The outcome of this skill is a scrubbing setup that catches PII at the boundary and redacts it in the least destructive mode that still protects the person. The costly mistake it prevents is redacting so naively that either PII slips through in free text or the data becomes useless for the job it was collected for.

Operating procedure

Detection precedes mode selection because the right redaction depends on what the downstream consumer needs from each field - decide per field, not per dataset.

Step 1: Gather inputs

• The data source: logs, database export, chat transcripts, prompt payloads, analytics events.
• Downstream use: debugging, analytics joins, support lookups, model training, third-party sharing. This decides the redaction mode.
• Whether records must remain joinable after scrubbing (tokenize) or only comparable for equality (hash) or neither (mask or remove).
• Jurisdictions and regimes in play (GDPR, CCPA, HIPAA). Default to the strictest plausible; label the assumption a guess.
• Locales in the data - phone, postal, and ID formats vary by country.

Step 2: Inventory the categories to detect

Names, emails, phone numbers, postal addresses, government IDs (SSN, passport), dates of birth, credit card and bank account numbers, IP addresses, MAC addresses, geolocation, biometric references, medical record numbers, vehicle plates, usernames, device IDs, URLs with embedded tokens, and free-text quasi-identifiers.