Compliance & Redaction — PII Auto-Redaction Guide

Velaro can automatically detect and redact sensitive personal data (SSNs, SINs, credit card

numbers, CVVs, bank account numbers, and your own custom patterns) as it flows through chat,

email, SMS, tickets, and social channels — before it's stored or shown in a transcript. This is

part of the Compliance & Redaction suite, managed from Settings → Compliance → Redaction.

What gets redacted by default

Every Compliance plan includes five built-in patterns, applied automatically with no setup:

Pattern	What it catches	Example replacement
SSN	US Social Security Numbers	[redacted ssn]
SIN	Canadian Social Insurance Numbers (context-gated)	[redacted sin]
Credit Card	13-19 digit card numbers	[redacted card]
CVV	3-4 digit security codes (context-gated)	[redacted cvv]
Bank Account	Bank account numbers (context-gated)	[redacted account]

"Context-gated" patterns (SIN, CVV, Bank Account) only fire when the surrounding text also looks

like the right context — this keeps ordinary short numbers from being flagged as false positives.

The actual sensitive value is never stored — only a safe hint (e.g. "matched 16-char numeric

string") is kept for diagnosing false positives.

Which channels and plans

Channel	Starter	Pro	Enterprise
Chat	✅	✅	✅
Email	—	✅	✅
SMS	—	✅	✅
Tickets	—	✅	✅
Social (Facebook/Instagram/Twitter/TikTok)	—	✅	✅
Voice transcripts (after-the-fact)	—	—	✅
Custom patterns	—	✅	✅
Per-group overrides	—	✅	✅
LLM-assisted detection + BYOK	—	—	✅
Audit log	✅	✅	✅

Turning a channel on or off

Every channel can be set to Inherit (use the site-wide default), On, or Off from the

Redaction tab's channel matrix. On Pro and Enterprise, you can also override per routing group —

a group's setting wins over the site default, and a channel setting wins over "no explicit

setting" at either level. If nothing is configured anywhere, redaction defaults to off for that

channel — Velaro never silently starts redacting a channel you haven't explicitly turned on.

Adding custom patterns

Built-in patterns cover the most common PII shapes, but your business may have its own sensitive

formats — an internal member ID, a policy number, a partner account code. From the Redaction tab's

Pattern list, add a custom pattern with:

• Name — a label shown in the audit log
• Pattern — a regular expression
• Replacement text — what customers/agents see instead (defaults to [redacted])

Custom patterns require Compliance Pro or higher and apply across every channel you've turned

redaction on for, right alongside the built-ins.

"Why was this redacted?" — the sample tester

If a customer or agent asks why something got masked, or you want to test a new custom pattern

before it goes live, paste sample text into the Redaction tab's tester. It runs the exact same

detection logic as live message scrubbing — not a simulation — and shows exactly which pattern(s)

fired. On Enterprise with the LLM pass enabled, it also reflects whether the AI layer is active for

the site.

The optional AI-assisted pass (Enterprise, BYOK-aware)

Regex patterns catch PII in known formats reliably, instantly, and for free. They will not catch

PII phrased in unexpected ways — a customer spelling a number out in words, or a novel ID format

your patterns don't cover. Enterprise plans can turn on an optional AI-assisted detection pass

that runs after the regex pass to catch more of that creative/context-dependent PII.

This is off by default, even on Enterprise. Turning it on is an explicit choice, and it comes

with real tradeoffs stated plainly in the settings UI:

• Adds latency to each message
• A small per-message AI cost
• Unless you configure BYOK (Bring Your Own Key), message text is sent to Velaro's LLM

provider for analysis

If your account already uses BYOK for other Velaro AI features, the compliance AI pass

automatically routes through your own configured AI endpoint instead of Velaro's — no separate

BYOK setup needed for compliance specifically. If the AI pass ever errors or times out, the

message still sends normally; the AI layer only ever adds detection on top of the regex pass; it

never blocks or delays delivery of a message.

Pairs with SecureForms — use the right tool for each kind of data

Redaction and SecureForms solve two different problems and are meant to work together, not

compete:

• Use SecureForms for anything that must never touch Velaro's database at all — card numbers,

payment details. SecureForms routes that data through a certified card injector before it ever

reaches Velaro's data path.

• Use Redaction for freeform text where PII might appear unexpectedly — a customer typing

their SSN into a chat message, an agent pasting an account number into a note.

Data that has already gone through SecureForms is automatically excluded from redaction scanning

of the surrounding conversation — it's already been through a PCI-scoped path with its own field

boundaries, so re-running the general scrubber over it would be redundant at best.

The audit log — proof for compliance audits

Every real redaction (built-in, custom, or AI-assisted) writes a row to the audit log, visible

from the Redaction tab's Audit tab: which pattern fired, whether it was built-in or custom, the

conversation it happened in, and the direction (visitor or agent). This is what you hand to your

own compliance auditor as evidence redaction is actually running — not just that a setting is

turned on somewhere.

Related

• [Audit Trail Guide](/article/audit-trail-guide)
• [SecureForms Guide](/article/secure-forms-guide) — PCI-scoped field capture (card numbers, payment details)