PII Scanning

Sylo can scan outbound request bodies for personally identifiable information (PII) before they reach external APIs.

Configuration

Set PII scanning per-session:

const session = await sylo.createSandboxToken({
  // ...
  pii: {
    action: "redact",  // "redact" or "block"
    patterns: ["ssn", "credit_card", "email", "phone"],
  },
});

Actions

• redact — replace detected PII with [REDACTED] and forward the request
• block — reject the entire request with a 403 response

Supported patterns

Pattern	Matches
ssn	Social Security Numbers (e.g., 123-45-6789)
credit_card	Credit card numbers (Luhn-validated)
email	Email addresses
phone	Phone numbers (US and international formats)

Audit trail

PII detections are logged in the audit trail:

const { events } = await sylo.queryAudit({ tenantId: "acme" });
// event.piiDetected: ["ssn", "email"]
// event.piiAction: "redact"

Combining with policies

PII scanning runs after policy checks. If a request is denied by policy, PII scanning is skipped. If the request is allowed but contains PII:

• redact: PII is replaced, request forwarded
• block: request rejected, logged as PII violation