PII Redaction

Overview

PII Redaction is a data privacy system with two parts:

1. PII Access Control restricts which team members can see sensitive data (phone numbers) in the TrackDrive UI, exports, and logs.
2. PII Auto-Redaction permanently removes selected personal data from aged records after a configurable retention period.

Both are configured under Company > PII & Security. Only the
company owner can modify PII settings.

PII Access Control (Display-Time Masking)

When enabled, caller phone numbers are masked everywhere in
the platform for all users except those explicitly granted
access. Masked numbers appear as partially hidden (e.g.,
"+1719xxxx234").

Masking applies to:
- Data grids (calls, leads, contacts, logs)
- Data exports and quick exports
- Webhook logs and system logs
- Text message records

To grant a user access to view unmasked phone numbers, add
their email to the PII access list on the Security page.

When PII restriction is active, TrackDrive support staff
cannot impersonate users who have PII access. This prevents
support personnel from viewing restricted data.

PII Auto-Redaction (Permanent Removal)

Auto-redaction permanently destroys selected personal data
fields from records that exceed the configured retention
period. This is irreversible. Once redacted, the original
data cannot be recovered.

Configuration

• Enabled/Disabled toggle: turns auto-redaction on or off.
• Retention period: how many days to keep data before redacting (30 to 2,555 days; default 90 days).
• Redaction method: how values are replaced:
  • Nullify: replaces values with a placeholder marker. The original data is gone.
  • Hash: replaces values with a one-way fingerprint. The original data is gone, but the same input always produces the same fingerprint, preserving correlation for analytics without exposing the actual data.
• Fields to redact: select which personal data fields to scrub. Available fields include names, email, address, date of birth, IP address, demographics, and geographic data.

What Records Are Affected

Auto-redaction processes:
- Call records (including archived calls)
- Archived lead records
- Associated data store entries for those records

Both fixed fields and JSON-stored custom data are scrubbed.

When Redaction Runs

The auto-redaction process runs hourly during non-business
hours. It processes records in batches, so large backlogs
are handled incrementally over multiple cycles without
impacting platform performance.

Terms of Service Requirement

Enabling PII auto-redaction requires accepting the Terms of
Service. Companies are responsible for ensuring they have
exported any data they need to retain before the retention
period expires.

Important Considerations

• Auto-redaction is permanent. There is no undo.
• Export your data before the retention window closes if you need historical records.
• Access control (display masking) does not delete data. It only hides phone numbers from unauthorized users.
• Auto-redaction and access control are independent. You can use either or both.