Why format redaction still points to the same customer

Support, ops, and on-call engineers already treat a conversational AI as a drafting tool: paste a complaint, a log, a meeting note, wait for a cleaner reply. The paste box still looks like it sits in your browser. After you submit, the text has left the current tab. The model vendor decides, under its own terms, whether that text is used for training, written into history, or kept again for a safety review. Stars you type on your machine only affect that request if they are in place before you hit send.

In April 2023, engineers in Samsung’s semiconductor business pasted material that should not have left the building into ChatGPT three times in about twenty days: source from a semiconductor database, defect-inspection code, and internal meeting notes. PCMag, citing Korean coverage in The Economist, recorded those three incidents. Bloomberg reported in May 2023 that the company then banned generative AI on work devices. None of the three was “we forgot to star a phone number.” What walked out was source, an algorithm, and meeting content.

That same year, Cyberhaven published workplace telemetry from about 1.6 million employees at companies using its product. An update around June 2023 stated that, since ChatGPT became public, about 4.7% of those employees had pasted confidential material into it at least once, and that about 11% of what employees pasted into ChatGPT was labeled confidential. The numbers sit on Cyberhaven’s own blog. This is one vendor’s telemetry, not an industry census, and the rates should not be stretched onto every 2026 support desk. What you can check is narrower: pasting work text into a consumer chat box was already common enough in 2023 to ask, separately, what a pre-paste mask actually changed.

That is a different layer from “why a rotated key should not go back into chat.” That article is about an API key that is pasted into a searchable channel after rotation; see After a cloud env-var leak, why the new key should not go back into chat. This piece covers the everyday channel next to it: tickets, mail, and logs, and which identity layer format redaction changes before they enter an AI — and which layer is still sitting there in plain words.

UsePwd Redaction masks text in the current tab. Open it and use it — no sign-up. Detection is fixed at six types: phone, ID number, bank card, email, API key, and IP. The source is not sent as an HTTP body and is not written to analytics. A single paste is capped at 512 KB; split anything larger. This is not natural-language understanding. It does not score “Maya Chen,” and it does not decide whether “12 Example Street” is a home address.

Phones are caught as mainland mobile numbers, international numbers that start with +, and common North American writing. For ID numbers, an 18-digit resident ID is checked with its checksum before the rule fires, so a random order digit string is less likely to be treated as an ID; the page also accepts the older 15-digit form, a U.S. Social Security pattern written as 123-45-6789, and some passport-like letter-plus-digit strings. Cards need 13 to 19 digits and a Luhn check; whole 15-digit and 18-digit runs are skipped so they do not fight the ID rule for the same span. Emails are local-part @ domain. Keys are a public prefix list, including sk-, sk_live_, sk_test_, AKIA, ghp_, github_pat_, xoxb-, and Bearer . IPs cover IPv4 and some IPv6 writings.

Smart mask is the default: phones, ID numbers, and cards keep the last four digits; an email keeps the first character of the local part and the full domain; a key keeps its prefix and the last four; IPv4 keeps the first two octets. Full mask turns each hit into stars of the same length; an email becomes ***@***, and a key still keeps a recognizable prefix plus ***. Both modes change only the spans they hit. The right side lists the types and counts from this run, so you can compare instead of taking a verbal “it’s anonymous.”

GDPR Article 4(5) defines pseudonymisation as processing personal data so it can no longer be attributed to a specific person without additional information held separately. Recital 26 then keeps that result inside personal data: information that has been pseudonymised, and that could be attributed again with extra information, is still information about an identifiable person. The same recital sets anonymous information outside the Regulation — data that does not relate to an identified or identifiable person, or that has been rendered anonymous so the person is no longer identifiable. The consolidated text is on EUR-Lex. Turning +1 415-555-0134 into ***********0134 is a common pseudonymisation move. It is not anonymisation. Anyone who still holds the full ticket, a call recording, or an order store can join the last four, the email domain, and the complaint.

The ICO puts the same split in plainer English. Its pseudonymisation page states that pseudonymised data remains personal data, and that the technique is a risk-reduction measure, not a way to push the text outside the law. Smart mask keeps the last four and the domain on purpose so an agent can still check “did we change the line we meant to change.” That leftover is not a warrant to hand the paragraph to any third party. Full mask removes those leftovers and raises the join cost. A name, an address, a ticket ID, and the plot do not disappear because you flipped that switch. Reading “more stars” as “no longer identifiable” is treating pseudonymisation as anonymisation.

An email domain is often more dangerous than the local part. @example.com on a consumer mailbox points weakly. @a-twenty-person-company plus “they asked for the refund at 4 p.m. yesterday” is almost a name inside that company. IPv4 left as 203.0.*.* means little on the public internet; on a one-subnet office LAN, the subnet itself is a clue. A key left as sk_test_ or ghp_ tells the downstream reader which class of credential once sat there. A prefix is not the secret. It is a label.

A two-word name has no checksum. An address is a street, a building, and a door number, not a fixed width. Ticket IDs, order IDs, and tracking numbers are invented per vendor: WO-20260903-8842 today, another prefix tomorrow. A chat AI asked to draft a reply needs exactly that plot: when someone called, where the parcel landed, what was promised. If a format engine blanked all of it, the draft would be useless. If it leaves all of it, the identity layer is still there.

So the lines that most need a human delete are often not the phone. The phone is the easy hit. Worth a second look: how the contact is named, whether a full address is sitting there, whether a searchable ID is sitting there, and whether a time plus a detail can lock one call. Leave those four in the prompt and then call the text “redacted,” and you have only shown that the phone line got shorter.