PII scrubbing for analytics data
How the PII scrubber redacts emails, tokens and other PII from URLs, referrers and event properties before storage, plus custom rules and a redaction log.
Personal data often leaks into analytics by accident: an email in a confirmation URL, a password-reset token, a phone number in a search. The PII scrubber replaces it before anything is stored. It's on by default. Turn it off or on with Scrub personal data in Site settings → Privacy → PII scrubber. Off disables the built-in rules and your custom rules.
What it checks#
Page paths (after path masks), referrer paths and text property values, with these rules:
| Rule | Finds | Replacement |
|---|---|---|
email |
Email addresses | [redacted-email] |
jwt |
JWT-like tokens (three base64 segments starting with eyJ) |
[redacted-token] |
secret |
Values of token=, key=, secret=, password=, pass=, auth= and session= parameters |
[redacted] |
uuid |
UUIDs | [redacted-id] |
long_id |
Hexadecimal ids of 32 characters or more | [redacted-id] |
digits |
Runs of 10 or more digits (spaces and dashes allowed), such as phone and card numbers | [redacted-number] |
For example /reset?token=abc123 becomes /reset?token=[redacted] (if
token were an allowed parameter at all), and
/users/[email protected] becomes /users/[redacted-email].
It checks the text inside list-valued properties too. It does not check
event names, property keys, hostnames, UTM values or ref. Keep personal
data out of those yourself.
Custom rules#
Add your own in Site settings → Privacy → PII scrubber. They run after the built-in rules.
| Field | What it does |
|---|---|
| Rule name | The name the rule gets in the redaction log. Optional: unnamed rules are logged as custom |
| Regular expression | What to find, for example customer numbers like CUST-\d{6}. Case-sensitive. Every match becomes [redacted]. An invalid expression is rejected when you save |
A site can have up to 20 custom rules. Rules run on every pageview, so an
expression must be at most 200 characters and must match in linear time:
backreferences such as \1 are refused when you save, with the reason.
If a value is longer than 4,096 characters, or a rule takes too long on
it, the whole value is stored as [redacted]. The scrubber never lets a
value through that it could not check.
Redaction log#
The same tab shows how often each rule fired over the last 30 days, so you can find and fix the leak at its source. We count redactions per day and rule but never keep the redacted values.
It's a safety net#
Fix leaks where they start: don't put personal data in URLs, and don't send it as event properties. Use path masks for ids in paths.