Skip to content

Concept map· 6 connected terms

PII Masking

Also called: Data masking · PII redaction · Log redaction

In one line
Replacing personal data such as phone numbers, names and emails with partly hidden values in logs, agent screens, exports and AI prompts.

Reviewed

What is PII masking?

PII masking is the practice of hiding personally identifiable information (PII), such as phone numbers, names, email addresses, postal addresses, ID numbers and OTP codes, by replacing all or part of each value before it is displayed, logged, exported or passed to another system. A WhatsApp number such as +91 98765 43210 becomes 91••••••3210: still recognisable to the customer and useful to an agent confirming identity, useless to anyone scraping a log file.

Several techniques are chosen field by field. Static masking permanently rewrites data in copies such as test databases and analytics exports. Dynamic masking hides values at display time based on the viewer's role, so a supervisor sees a full number and an agent sees the last four digits. Redaction removes a value entirely (an OTP in a log line becomes [redacted]), while tokenisation swaps it for a reversible reference held in a secure vault, which helps when a downstream worker must later act on the real wa_id to send a reply.

Masking protects data while it is being used (on screens, in logs, in prompts to a Large Language Model) whereas Encryption at Rest protects data while it is stored. It also differs from Number Masking in telephony, which hides both parties' real numbers behind a proxy number during calls. Under the Digital Personal Data Protection Act (DPDP Act), the DPDP Rules 2025 list masking alongside encryption, obfuscation and virtual tokens as security safeguards, with most obligations phasing in by 2027, and India's CERT-In directions require logs to be kept for 180 days, so what goes into those logs, and the Data Retention schedule that governs them, matters.

Key takeaways

  • PII masking replaces personal data with partly hidden values, so people and systems that do not need the raw data never see it.
  • Mask at the point of capture, before data reaches logs, analytics, exports or an LLM prompt; masking cannot be undone downstream.
  • Keeping the country code and last four digits of a phone number is usually enough for an agent to confirm identity.
  • Masking protects data in use; encryption at rest protects stored copies. Most messaging platforms need both.
  • The DPDP Rules 2025 list masking among the security safeguards a data fiduciary can use to protect personal data.

Mask a log line before it leaves your server

Masking hides personal data before it reaches logs and dashboards, while keeping enough to recognise it.

Try

Text with email addresses or phone numbers.

Masked: safe for logs, exports and prompts
INFO inbound wa_id=••••••••5678 text="Please call me on ••••• •2345 after 6"
Emails
0
Numbers
2
  • Masked 2 phone or long numbers.
  • Numbers keep their last 4 digits — enough to confirm with a customer, useless to a fraudster.
  • Masking is one-way: do it before text reaches logs, analytics or exports.
Pick a log line, an agent note or an AI prompt, or type your own: long numbers keep only their last four digits, emails their first letter and domain. The AWB number is masked too while names pass through, which is why field rules sit on top of a pattern pass.

Example: Masking at a Jaipur jewellery brand's support desk

A Jaipur jewellery brand runs WhatsApp support with 25 agents and sends conversation summaries to an LLM. An internal review finds full customer numbers and home addresses in the error-tracking tool and in prompts. The team adds logger redaction for wa_id and phone fields, a pattern pass that masks numbers and emails in free text, and a prompt scrubber that swaps them for tokens like <PHONE_1>. Agents now see 91••••••3210 with a reveal button for delivery calls, and every reveal is written to the Audit Log. The summaries are just as useful, and the next vendor security questionnaire is much shorter.

How does PII masking work?

  1. Classify the fields

    List every PII field the messaging stack handles (wa_id, from, contacts[].profile.name, message text, addresses from location or address messages, emails, OTP values) and decide for each: keep, mask, redact or tokenise.

  2. Mask at ingestion

    In the webhook handler, keep the raw value only where operations need it (the conversation record) and pass masked or tokenised values to everything else: logs, analytics events and reporting queues.

  3. Redact logs structurally and by pattern

    With Structured Logging, configure the logger to redact known paths such as *.wa_id, *.phone and req.headers.authorization, then run a pattern pass over free text, because customers type numbers and emails into messages.

  4. Mask by role on screens and exports

    Show agents the country code and last four digits with a reveal action that is logged; make exports masked by default and require approval for raw data.

  5. Scrub prompts before AI

    Replace phone numbers, emails and IDs in transcripts with placeholders such as <PHONE_1> before they leave your system, and keep the mapping server-side as part of your AI Guardrails so replies can be re-personalised afterwards.

PII masking in code

import pino from "pino";
 
// "919876543210" -> "91••••••3210": country code and last four digits only
// (assumes a two-digit country code such as 91).
export function maskPhone(value) {
  const d = String(value).replace(/\D/g, "");
  if (d.length < 8) return "[redacted]";
  return d.slice(0, 2) + "•".repeat(d.length - 6) + d.slice(-4);
}
 
const EMAIL = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g;
const PHONE = /\+?\d[\d\s-]{8,}\d/g;
 
// Free text: customers type numbers and emails into messages.
export const maskText = (text) =>
  text
    .replace(EMAIL, (m) => `${m[0]}•••${m.slice(m.indexOf("@"))}`)
    .replace(PHONE, (m) => maskPhone(m));
 
// Structured fields: never let these paths reach the log sink in clear.
export const logger = pino({
  redact: {
    paths: ["req.headers.authorization", "wa_id", "*.wa_id", "phone", "*.phone", "*.otp", "contacts[*].profile.name"],
    censor: "[redacted]",
  },
});
 
logger.info({ event: "inbound", wa_id: "919812345678", text: maskText("Call me on 98450 12345") });
// {"event":"inbound","wa_id":"[redacted]","text":"Call me on 98••••2345"}

Mask emails before phone numbers, since email addresses can contain digit runs.

Common wrong turns

Common mistakes with PII masking

  • Masking only structured fields

    Logger redaction of wa_id misses the same number typed into a message body, or an address from a location message. Add a pattern pass for free text and test it with realistic samples.

  • Masking too late

    Once raw data has reached a log pipeline, an analytics tool or a model provider, masking the dashboard does not undo it. Mask at ingestion and at every boundary where data leaves your core system.

  • Treating hashing as masking

    An unsalted hash of a 10-digit Indian mobile number can be reversed by hashing every possible number. Use a keyed hash (HMAC) or vault tokens when you need a stable pseudonymous ID.

  • Breaking operations

    Masking the wa_id a reply worker needs, or the digits agents use to confirm identity, pushes teams to work around the control. Keep raw values where operations need them and mask everywhere else.

Key facts at a glance

PII masking: key facts and limits

Typical phone mask
Country code + last four digits
Mask vs redact vs tokenise
Partly hidden / removed / reversible via a vault
Where to apply
Logs, screens, exports, analytics, LLM prompts
Free-text risk
Customers type numbers and emails into messages
India log retention
180 days (CERT-In directions, 2022)
DPDP Rules 2025
List masking among security safeguards

Why does PII masking matter?

Most personal-data leaks are not dramatic database breaches. They are log files shipped to a third-party tool, a CSV export emailed to a vendor, a screenshot of an agent's screen, or a chat transcript pasted into an AI model. A WhatsApp platform touches phone numbers on every single webhook, so without masking, raw numbers spread into every system the business runs. Masking at the edges shrinks the number of people and systems that ever see real data, which limits breach impact, eases DPDP Act obligations and makes access reviews far simpler.

Good practice

Best practices for PII masking

  • Write unit tests with fake Indian numbers in several formats: +91, 0-prefixed, spaced and hyphenated.
  • Record every reveal of a masked value as an audit event with who, when and why.
  • Use a token map such as <PHONE_1> in AI prompts so replies can be re-personalised safely.
  • Review new log lines for personal data in code review, the same way you review for secrets.

PII Masking FAQs

What is the difference between data masking and encryption?+
Masking hides part of a value from whoever views it and is usually irreversible; encryption makes the whole value unreadable without a key and is reversible. Masking protects data in use, encryption protects data stored or in transit.
Should I mask phone numbers in WhatsApp webhook logs?+
Yes. Every webhook carries `wa_id` and `from` values, so unmasked logs become a copy of your customer list. Log a masked number or a keyed pseudonymous ID, and keep the raw value only in the conversation store.
How do I remove PII before sending chats to an LLM?+
Replace phone numbers, emails, names and IDs with placeholders such as <PHONE_1> before the prompt leaves your system. Keep the mapping server-side and restore values in the reply only where they are needed.
Is masked data still personal data under the DPDP Act?+
Often yes, if it can still be linked to a person using other information you hold. Masking reduces exposure and risk, but the data stays in scope while it remains identifiable.

See InfiQ pricing

Try it on the official WhatsApp Business API

InfiQ is an official Meta Business Partner. Start a 7-day free trial — no card needed — and see this running on your own number.

Start free trialBrowse all 550 terms