Masking Sensitive Data (PII) in Voicebot

overview calls handled by your voicebot often contain sensitive personal information — a caller may read out a card number, an aadhaar or pan number, a phone number, or their address by default, everything the caller says is saved as is in the call transcript pii masking lets you automatically detect and redact this sensitive information from your saved transcripts, so no clear text personal data is stored this helps you meet data privacy requirements (such as the dpdp act and pci dss) and reduces risk when transcripts are viewed, shared, or exported masking is opt in and configured per bot , so you decide which bots need it and exactly what should be redacted what pii masking does when you turn masking on for a bot, after each call ends the platform scans the transcript, identifies sensitive information, and replaces it with a masked placeholder before the transcript is stored for example caller my card number is 4111 1111 1111 1111 and my aadhaar is 1234 5678 9012 becomes caller my card number is \[card] and my aadhaar is \[aadhaar] the masked version is what gets saved and shown in your interaction history — the original clear text values are not retained what is detected out of the box with masking enabled, the following common types of pii are detected and redacted automatically, no configuration needed names of individuals phone / mobile numbers email addresses aadhaar numbers pan numbers bank account numbers credit / debit card numbers passport numbers date of birth physical addresses each match is replaced with a readable category label such as \[phone], \[email], or \[card] custom rules for business specific data every business has sensitive data that isn't a standard identifier — employee ids, policy numbers, internal account formats, and so on you can add custom rules describing this information in plain language, and it will be masked alongside the standard types see add custom masking rules below what is not covered a few things are intentionally out of scope so you can set expectations correctly only transcript text is masked the call's audio recording is not altered masking applies to calls made after you enable it transcripts already stored before you turned masking on are not changed live/real time data is not masked if you receive transcript events over webhooks during a live call, those are delivered unmasked masking is applied to the stored post call transcript how to enable pii masking open the bot you want to configure and go to general settings find the mask sensitive data section and switch the toggle to enabled once enabled, the standard pii types listed above are masked automatically no further setup is required for basic masking to also mask business specific data, add one or more custom rules (below) save your settings when the toggle is disabled , transcripts for that bot are stored as is with no redaction switching it off does not restore masked values in transcripts that were already processed while it was on add custom masking rules custom rules let you tell the bot, in your own words, what additional information to redact in the mask sensitive data section, select + add rules in the add sample value for pii redaction window, use the information type description box to describe the type of information you want masked write it as a plain language instruction review the on screen examples for guidance select save each rule can be up to 500 characters examples of good rules "redact all 6 digit employee ids" "mask customer account numbers starting with acc " "hide social security numbers in format xxx xx xxxx" "redact all sensitive personal identifiers including full names, 16 digit credit card numbers, dates of birth (dd/mm/yyyy), aadhaar numbers, and complete residential addresses " tips for writing effective rules be specific about the format where you can (number of digits, prefixes, patterns) this helps detection accuracy describe the type of information, not a single example value — the rule generalizes to all matching content if you're unsure whether something counts as sensitive, add a rule for it masking errs on the side of redacting where you'll see masked transcripts once masking is enabled and a call completes, the redacted transcript appears in interaction history any values matched by the standard types or your custom rules are shown as masked placeholders rather than the original text there is a short processing step after a call ends before the masked transcript becomes available (typically within about 30 seconds) frequently asked questions does masking affect the audio recording? no only the text transcript is masked the audio recording is unchanged will my old transcripts be masked if i turn this on now? no masking applies only to calls that happen after you enable it transcripts stored earlier are not retroactively redacted can i choose exactly which fields are masked? the standard pii types are always covered when masking is on beyond that, you control what else is redacted by adding custom rules you can add, edit, or remove rules at any time is masking on by default? no it is off unless you enable it on a specific bot, so existing bots keep their current behavior until you change it what happens if the caller says something sensitive that isn't a standard type and i haven't added a rule for it? it may not be masked add a custom rule describing that information so it's covered on future calls does masking slow down the call? no masking runs after the call ends, as part of saving the transcript it does not affect the live conversation