Home / Help centre / Security & privacy
Security & privacy
What kinds of personal data are redacted?
Cyberlop redacts four kinds of detected personal data in profile text before analysis: email addresses, phone numbers, SSNs and payment card numbers. It keeps IP addresses and URLs, because the scan needs them to find your app and test it.
The short version
Four kinds of personal data get redacted, and two kinds of technical detail do not. The Reporting section of a scan profile lists them in a note under the rules of engagement field.
| Type | Redacted? |
|---|---|
| Email addresses | Yes |
| Phone numbers | Yes |
| SSNs | Yes |
| Payment cards | Yes |
| IP addresses | No, kept for the scan |
| URLs | No, kept for the scan |
How it works in Cyberlop
The note on the profile form reads: "Detected PII (emails, phone numbers, SSNs, payment cards) in these fields is automatically redacted before analysis. IPs and URLs are kept so the scan can use them."
The word detected matters. Cyberlop looks for patterns that resemble those types and cannot promise to catch every unusual format. A name written in a sentence, or a customer number unique to your company, may not match any pattern.
The scan needs IPs and URLs to know where to look, so redacting them would break the job. If one of them shows up in a place you did not expect, read why IPs stay visible after redaction.
The safest habit is to keep real personal data out of the fields in the first place. Describe your app with made-up values, such as user@example.com, and let redaction act as the second line of defence. The glossary entry on personal data covers why this matters.
What to do next
- Read which profile fields get redacted.
- Open your profile and check the Reporting section for stray details.
- Write cleaner guidance with how to write report guidance.
Not sure about a field? Ask through /contact.
Related questions
- Does Cyberlop redact personal data I type into a profile?
- IP addresses and URLs in my rules of engagement weren't redacted. Is that expected?
- How do I steer how the final report is written?
- Is my code sent to an AI provider?
- How does Cyberlop store my credentials and tokens?
Reporting rules in Cyberlop: severity, confidence, guidance and PII redaction
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Security question we did not answer?
Our team will answer it directly, or walk through it on a call with your security lead.