How the gate works

PII Detection for Structured Data

This tool grades each column of a structured dataset for exposed PII. Each signal is scored 0–2; the verdict is the weakest one — then a gate that can only make it worse.

The 8 signals

01customer_id (not PII)

02full_name (low)

03email (moderate)

04phone (moderate)

05ssn (regulated)top trigger

06dob (moderate)

07plan (not PII)

08signup_ip (low)

SAFE TO USE

every PII column meets its class minimum

REMEDIATE

a column is under-protected, or a low/moderate column is exposed

HOLD

a regulated column is left exposed

Regulated-exposed gate · worsen-only

One regulated column left exposed holds the whole dataset - HOLD regardless of how many columns are clean. 83% handled with an open SSN column is still a HOLD.

HOLD

Why: Every column is handled except the SSN, which is regulated and stored unmasked - one regulated column exposed - so the dataset is HOLD even at 83% of PII handled. weakest signal 0/2 · 7 of 8 columns handled, 83% of PII.

Fix firstssn - mask, tokenize, or encrypt the SSN column before the dataset moves anywhere; a regulated field in the clear holds everything.

A clean sheet didn’t save it. The verdict is the weakest signal — and a top trigger is dispositive on its own — so it names the one thing to fix first. Grades handling you describe against each class's minimum, not your regulatory obligations. Not legal advice.

RedHub AIthe AI that tells you when to doubt it redhub.ai/systems/pii-detection-structured-data