PII Detection and Masking

PocketPaw includes an opt-in PII detection and masking system that scans text for sensitive personal information and applies configurable actions before data is stored in memory, audit logs, or application logs.

Overview

When enabled, the PII scanner runs on:

• User messages before saving to session memory
• Assistant responses before saving to session memory
• Audit log entries before writing to ~/.pocketpaw/audit.jsonl
• Application logs via an optional log filter

The scanner is regex-based with pre-compiled patterns for performance. It runs on every matching text block and deduplicates overlapping matches.

Detected PII Types

Actions

When PII is detected, one of three actions is applied:

You can set a default action and override per PII type.

Configuration

Environment Variables

POCKETPAW_PII_SCAN_ENABLED=true        # Enable PII scanning (default: false)
POCKETPAW_PII_DEFAULT_ACTION=mask       # Default action: mask, hash, or log
POCKETPAW_PII_SCAN_MEMORY=true          # Scan before writing to memory
POCKETPAW_PII_SCAN_AUDIT=true           # Scan audit log entries
POCKETPAW_PII_SCAN_LOGS=true            # Extend log scrubber with PII patterns

Config File (~/.pocketpaw/config.json)

{
  "pii_scan_enabled": true,
  "pii_default_action": "mask",
  "pii_type_actions": {
    "ssn": "hash",
    "email": "mask",
    "phone": "log"
  },
  "pii_scan_memory": true,
  "pii_scan_audit": true,
  "pii_scan_logs": true
}

Web Dashboard

Toggle PII scanning and configure actions from Settings > Security in the web dashboard.

Per-Type Action Overrides

Use pii_type_actions to set different actions for each PII type:

{
  "pii_type_actions": {
    "ssn": "hash",
    "email": "mask",
    "phone": "log",
    "credit_card": "mask",
    "ip_address": "log"
  }
}

With this config:

• SSN 123-45-6789 becomes [PII-SSN:a7f3e9c1d2b8]
• Email [email protected] becomes [REDACTED-EMAIL]
• Phone 555-123-4567 is logged but text stays unchanged

Scanning Existing Memory

Use the audit CLI to scan stored memory files for PII:

pocketpaw --audit --pii-scan

This scans all markdown files in ~/.pocketpaw/memory/ and session JSON files in ~/.pocketpaw/memory/sessions/, reporting findings without modifying the files.

Related