Home / Help centre / Security & privacy
Security & privacy
Does Cyberlop redact personal data I type into a profile?
Yes. Cyberlop redacts detected personal data in three free-text areas of a scan profile before analysis: rules of engagement, report guidance and application context. It keeps IP addresses and URLs, because the scan needs them to find and test your app.
The short version
Free text can hold personal data by accident. Cyberlop looks for it in the profile fields below and redacts what it finds before the AI engine reads anything.
| Profile field | Redacted before analysis |
|---|---|
| Rules of engagement | Yes |
| Report guidance | Yes |
| Application context | Yes, including text from Auto Generate from Repo |
| IP addresses and URLs | No, kept so the scan can use them |
How it works in Cyberlop
Open the Reporting section of a profile. Under the Rules of engagement field, a note says: "Detected PII (emails, phone numbers, SSNs, payment cards) in these fields is automatically redacted before analysis. IPs and URLs are kept so the scan can use them."
The Application context area carries a matching line: detected personal data is redacted before the context goes to the AI engine. The same applies to the Auto Generate from Repo button once you save the profile.
Redaction covers these text fields. It does not apply to credentials, which have their own protection: Cyberlop encrypts those and never shows them again. See how Cyberlop stores your credentials.
You should still avoid pasting real customer records into any free-text field. Redaction is a safety net, not a licence to be careless, and a clean description of your app works better for the scan anyway. Read about personal data if you want the wider idea.
What to do next
- See which kinds are caught in what kinds of personal data get redacted.
- If an address still shows, read why IPs stay visible.
- Learn the fields in reporting rules.
Questions? Contact us at /contact.
Related questions
- What kinds of personal data are redacted?
- IP addresses and URLs in my rules of engagement weren't redacted. Is that expected?
- How do I steer how the final report is written?
- Is my code sent to an AI provider?
- How does Cyberlop store my credentials and tokens?
Reporting rules in Cyberlop: severity, confidence, guidance and PII redaction
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Security question we did not answer?
Our team will answer it directly, or walk through it on a call with your security lead.