Redact sensitive fields

A capture stores every field on the page, including the ones that have nothing to do with consent. Redaction is how you keep sensitive values out of it.

Redaction happens in the browser, before anything is uploaded, so a redacted value is not sent. That also makes it permanent: there is no privileged copy, and you cannot recover the value later either. Redact narrowly.

Tag the field

Put data-ec-redact on the element whose value must not be stored.

<input type="password" name="password" data-ec-redact="full" />

<input
  type="text"
  name="card"
  autocomplete="cc-number"
  data-ec-redact="pan-last4"
/>

Two modes:

• full replaces the value with ••••. Use it unless you have a reason not to.
• pan-last4 replaces every digit except the last four, and only when the value holds at least twelve digits in total. Below that, every digit goes. It exists for the case where a support agent needs to recognise which card was used. It masks digits only, so any letters or punctuation in the value survive; use full where the surrounding text is also sensitive.

The attribute has to carry a value. A bare data-ec-redact with nothing after it redacts nothing, which is the failure most likely to go unnoticed, since the markup looks tagged. A misspelt value errs the safe way: anything that is neither none nor a spelling of pan-last4 is treated as full.

There is a third, stronger mode. data-expressconsent-mask empties the value outright rather than substituting bullets, and it outranks both of the above. It is the one to reach for when even the shape of the value matters.

What to redact, and what not to

Redact: passwords, payment card numbers, card security codes, bank account and routing numbers, government identifiers, one-time codes, health information, and anything your own policy says cannot be retained for five years.

Do not redact: the consent language, the consent checkbox, the submit control, or the contact details the consent is about. A record with a redacted phone number cannot be tied to the person now saying they never agreed, which is the only question the record exists to answer. Redact narrowly enough that the record still answers it.

Next