Unit 07.03: Logging content without leaking it

Redaction reduces exposure. It does not remove it, and being clear about that changes what else you have to do.

Patterns catch structure, not prose

Account numbers, emails, cards and phone numbers all have shapes. A customer describing their situation does not.

The code redacts a message containing four structured identifiers.

import re

PATTERNS = [
    (re.compile(r"\bACC-\d+\b"), "[ACCOUNT]"),
    (re.compile(r"[\w.+-]+@[\w-]+\.[\w.]+"), "[EMAIL]"),
    (re.compile(r"\b\d{4}[ -]?\d{4}[ -]?\d{4}[ -]?\d{4}\b"), "[CARD]"),
    (re.compile(r"\b\+?\d[\d ()-]{8,}\d\b"), "[PHONE]"),
]


def redact(text):
    for pattern, replacement in PATTERNS:
        text = pattern.sub(replacement, text)
    return text


RAW = ("[email protected] on ACC-1187, card 4111 1111 1111 1111, "
       "call +44 20 7946 0958")
print("raw     :", RAW)
print("redacted:", redact(RAW))

print("""
What this catches: structured identifiers. What it does not: a customer writing
their own name and address in free text, which no pattern matches.

So redaction reduces exposure and does not remove it. Retention limits and
access control are what bound the remainder.
""")

All four are caught. What is not caught is a user writing their own name and address in free text, which no pattern matches and which is just as much personal data.

So redaction is one control among three. Retention limits bound how long the remainder exists, and access control bounds who sees it - and both are needed precisely because redaction is incomplete.

The mistake this prevents

The mistake is treating redaction as sufficient and skipping the retention policy. A log store with good redaction and no retention limit accumulates years of partially-redacted personal data in a system built for debugging and reviewed less carefully than the primary one.

Takeaway

Redact structured identifiers on write, and pair it with retention limits and access control. Free-text personal data is not pattern-matchable, so redaction alone is never the whole control.

Mark complete