PII Detection

The contains_pii rule looks for personal data in prompts, responses and tool calls. Every identifier it detects is listed here, with the name to use in a rule and how a match is confirmed. The dashboard offers the same list.

Choosing what to detect

  • In the dashboard, open Rules → PII detection and choose identifiers one by one, or a whole region.
  • A rule's patterns list takes identifier names, region names (global, eu, nordics, gb, us), the country codes listed under a region, and phone for both phone patterns. An unknown name is refused when the rule is saved.
  • A region includes identifiers added later. Each addition is listed in the changelog. Name identifiers one by one if a rule must not change on its own.
  • A rule that names nothing detects email, phone, ssn.

How a match is confirmed

Where an identifier has a check digit or ranges that are never issued, a value of the right shape counts only if it passes that check, so an order number or a timestamp of the same length is not flagged. Where it has none, the format alone decides. An identifier whose format is shared with ordinary numbers, and that has no check or one too weak to tell them apart, counts only after a word that names it, on the same line, such as CPR before a Danish number or BSN before a Dutch one; only the number is matched. Under redact a match is replaced with [REDACTED:pii]; under block the request is refused.

Global

In a rule: global.

Email address
Name email
Example anna.berg@example.com
Confirmed by Format only
International phone number

E.164: + and 7 to 15 digits, without spaces.

Name phone_intl
Example +46701740605
Confirmed by Format only
Payment card number

Visa, Mastercard, American Express and Discover numbers, with or without spaces or dashes, confirmed by the Luhn check digit.

Name credit_card
Example 4111 1111 1111 1111
Confirmed by Luhn check digit
IBAN (bank account number)

Account numbers from the SEPA countries, written in capitals, as one run or in groups of four.

Name iban
Example DE89 3704 0044 0532 0130 00
Confirmed by Length for the country and mod-97 check digits
IPv4 address

Four numbers from 0 to 255.

Name ip_address
Example 192.0.2.10
Confirmed by Each part 0–255
Date of birth

A date written after "DOB", "date of birth", "born on" or "birthday".

Name date_of_birth
Example DOB: 12/04/1985
Confirmed by Format only

European Union

In a rule: eu, or one country: de Germany, es Spain, fr France, it Italy, nl Netherlands. eu also detects IBAN (bank account number), Danish CPR number, Finnish personal identity code (henkilötunnus), and Swedish personal identity number (personnummer), listed under their own regions.

German tax ID (Steuer-ID)

Eleven digits, optionally grouped 2-3-3-3. One digit appears two or three times in the first ten, and the last is a check digit.

Name steuer_id_de
Example 86 095 742 719
Confirmed by ISO 7064 check digit and digit pattern
Spanish national identity number (DNI)

Eight digits and a check letter, in capitals. Also the Spanish tax number (NIF) of a person.

Name dni_es
Example 12345678Z
Confirmed by Check letter (mod 23)
Spanish foreigner identity number (NIE)

X, Y or Z, seven digits and a check letter, in capitals.

Name nie_es
Example X1234567L
Confirmed by Check letter (mod 23)
French social security number (NIR)

Fifteen digits with the key, spaced or not; 2A and 2B for Corsica. Provisional numbers (3, 4, 7, 8) included.

Name nir_fr
Example 2 84 12 76 451 089 93
Confirmed by Sex, month and mod-97 key
Italian tax code (codice fiscale)

Sixteen characters in capitals. Codes where letters stand in for digits (omocodia) included.

Name codice_fiscale_it
Example RSSMRA85T10A562S
Confirmed by Date of birth and check character
Dutch citizen service number (BSN)

Nine digits after BSN, BSN-nummer or burgerservicenummer on the same line, passing the 11-proef.

Name bsn_nl
Example BSN 111222333
Confirmed by 11-check, after the word BSN

Nordics

In a rule: nordics, or one country: dk Denmark, fi Finland, is Iceland, no Norway, se Sweden.

Danish CPR number

DDMMYY-NNNN after CPR, CPR-nr. or CPR-nummer on the same line. Danish numbers have had no check digit since 2007, so a number on its own is not matched.

Name cpr_dk
Example CPR-nr. 070761-4285
Confirmed by Date of birth, after the word CPR
Finnish personal identity code (henkilötunnus)

DDMMYY, a century sign, three digits and a check character, in capitals. Includes the century signs added in 2023.

Name hetu_fi
Example 131052-308T
Confirmed by Date of birth and check character
Icelandic kennitala

DDMMYY-NNNN or ten digits. A person's number only: company numbers are not matched.

Name kennitala_is
Example 150385-2029
Confirmed by Date of birth and mod-11 check digit
Norwegian national identity number (fødselsnummer)

Eleven digits, optionally with a space after the date. D-nummer and H-nummer included.

Name fodselsnummer_no
Example 01058512326
Confirmed by Date of birth and two mod-11 check digits
Swedish personal identity number (personnummer)

YYMMDD-NNNN (+ from age 100) or with the century, YYYYMMDD-NNNN or twelve digits. Samordningsnummer included. Ten digits are matched only with the - or +.

Name personnummer_se
Example 811218-9876
Confirmed by Date of birth and Luhn check digit

United Kingdom

In a rule: gb.

UK National Insurance number

Two letters, six digits and A to D after National Insurance, NI number, NI no. or NINO on the same line. Prefixes that are never issued are ignored.

Name nino_gb
Example NI number: AB 12 34 56 C
Confirmed by Issued prefix, after the words National Insurance

United States

In a rule: us.

US phone number

Ten digits, optionally separated by -, . or a space. The area code and exchange cannot start with 0 or 1.

Name phone_us
Example 212-555-0123
Confirmed by Area code and exchange that can exist
US Social Security number

Written with dashes. Numbers that are never issued (area 000 or 666, group 00, serial 0000) are ignored; ITINs are included.

Name ssn
Example 123-45-6789
Confirmed by Excludes numbers never issued

Missing an identifier?

Tell us which one and where it is used at support@signalvault.io. Each identifier ships with tests of valid values, values that fail its check and look-alikes, and is named in the changelog. Until then, a regex_match rule can match your own format.