PII masking
Which audit fields are masked when PII masking is enabled, and how existing events are treated.
Masked fields
When AUTOPIL_LOG_PII_MASK=true, three fields are masked before each new audit event is written. Existing events are not modified.
| Field | Stored as | Notes |
|---|---|---|
query | sha256:<16-char hex> | Tenant-salted SHA-256 of the raw query |
user_id | uid:<16-char hex> | Tenant-salted hash — consistent within a tenant, so per-user filtering still works |
reason | Preserved, query=<value> substrings replaced with query=sha256:<hash> | Policy decision context is kept intact; embedded query content is removed |
Badges and integrity
Events written with masking enabled carry "pii_masked": true. The dashboard Event Detail drawer shows a PII masked badge on these events. The context_hash is unaffected — chain integrity verification continues to work normally.
Was this page helpful?