Card numbers, tokens and personal data that slip into your logs can now be masked before they are stored. The Atatus Sensitive Data Classifier (SDC) scans logs as they arrive, finds sensitive values with library rules or your own regex, and hashes, redacts or partially masks them.
Security and platform teams get this without building a separate pipeline or deploying extra infrastructure. Every match is tagged, so you can search, chart and alert on where sensitive data shows up.
What the Sensitive Data Classifier does
- Scanning at ingestion: Matching runs in the Atatus ingest path, and only the masked version of a log event is written to storage.
- Maintained rule library: Detect card numbers from the major networks, IBANs, email addresses, phone numbers, UK National Insurance numbers, US passport numbers, Canadian SINs, JSON Web Tokens, Bearer tokens and HTTP authentication headers.
- Custom regex rules: Add your own patterns for internal identifiers or API keys, tag them, and test them on a sample line before you enable them.
- Choose the match action: Hash the value, redact it with your own replacement text, partially redact it from the left or right, or keep it and only tag the event.
- Fewer false positives: Require a keyword such as "card" or "cvv" near a match before it counts, and scope rules to specific attributes.
- Scanning groups: Use filters to target specific services or environments, set the order groups run in, and scan all matching logs or a sample.