Glossary

On-device redaction

On-device redaction masks sensitive values at the point of detection, on the endpoint, so the unredacted value never enters an event record, a log line, or a network request. It is masking — destructive and irreversible — not tokenisation.

MESSAGE SEND
Caught at the composer, while stopping it is still possible.
Not to be confused with Tokenisation Hashing Server-side redaction

Three techniques

Only one of them is redaction.

The word is used loosely in this market. ***-**-6789 is masking — there is no key anywhere that restores it.

Hashing deserves a specific warning. An SSN has roughly a billion possibilities, so an unsalted hash of one is recoverable by brute force in seconds. A hash is not redaction for low-entropy identifiers. If a product stores hashed identifiers server-side, the salt handling is the whole question.

Masking, tokenisation and hashing compared
TechniqueReversible?What it is for
Masking / redactionNo — characters destroyedKeeping the value out of every downstream system
TokenisationYes, with the vault keyPreserving referential integrity; a payments pattern
HashingNot directly; brute-forceable at low entropyMatching and deduplication

Where it happens is the point

“We redact sensitive data” describes two very different systems.

Redact at rest, server-side. The raw value was transmitted, processed, and probably logged somewhere in the path before redaction occurred. The claim is about the final database row.

Redact at detection, on-device. The unredacted value never populates a serialisable structure at all.

Only the second means the value never left the machine. Ask which one, and ask where in the code path masking is applied.

What correct implementation requires

Five properties, and the first is where leaks live.

  1. 01

    Mask before the record is constructed

    Not before it is transmitted. The window between those two points is where leaks live.

  2. 02

    Apply it to logs too, including debug builds

    Most real PII leaks in security products are a debug print somebody forgot to remove, not an exfiltration feature.

  3. 03

    Get the span right

    A finding with the correct type and the wrong offsets means part of the real value survived into the record. Span accuracy is a redaction property, not a classification nicety.

  4. 04

    Encrypt the local buffer anyway

    Defence in depth: treat even redacted records as sensitive at rest.

  5. 05

    Enforce it in CI

    So the property is a build gate rather than a convention.

Related terms

Ask where in the code path masking happens.

“Before the record is constructed” and “before it is transmitted” are different answers.