Top 20 Corporate Data Types Leaked to AI — Real-Time Masking & Compliance Guide
Over 82% of enterprise AI data leaks occur when employees paste customer PII, DevOps secrets, financial records, or privileged legal IP into ChatGPT, Claude, Gemini, or Copilot. Audit the 20 critical risk vectors below, search by regulation or entity type, and see exactly how PrivacyScrubber sanitizes each parameter locally in your browser's RAM before transmission.
The 20 Corporate Leak Vectors Directory
Click or highlight any parameter sample below to test zero-trust tokenization in real time.
Full Names
Customer, patient, or employee names in diagnostic notes & HR reviews.
Direct personal identifier under GDPR Art. 4(1) & HIPAA Safe Harbor § 164.514(b)(2)(i)(A). Stripped in RAM before prompt submission.
HR Masking Rules →Email Addresses
Exfiltrated during CRM exports, support transcripts & bulk AI drafts.
Direct personal identifier under GDPR & CCPA. Matched via strict RFC 5322 regex and replaced with sequential tokens.
CRM Masking →Phone Numbers
Found in support tickets, intake forms & sales call transcripts.
HIPAA Safe Harbor § 164.514(b)(2)(i)(D). Matches international E.164, national hyphenated, and parenthetical phone patterns.
Healthcare Rules →Date of Birth (DOB)
Pasted in medical AI summaries, insurance claims & HR onboarding.
HIPAA Safe Harbor § 164.514(b)(2)(i)(C). Prevents re-identification via voter records and public census databases.
PHI De-ID Guide →SSN & National IDs
HR onboarding, background checks & loan underwriting prompts.
Highest-risk direct identifier. Identity theft risk under GDPR Article 87 & HIPAA item (G). Masked while preserving surrounding context.
HR Redaction →Medical Record Numbers
Pasted in clinical AI summaries, EHR exports & diagnostic prompts.
HIPAA Safe Harbor § 164.514(b)(2)(i)(H). Converts clinical IDs to [MRN_N] so LLMs analyze medical logic without PHI exposure.
HIPAA Safe Harbor →Insurance & Plan IDs
Health plan member IDs pasted into AI billing dispute prompts.
HIPAA Safe Harbor § 164.514(b)(2)(i)(I) — Health plan beneficiary numbers and BCBS/Aetna/UHC group IDs.
Healthcare Profile →API Keys & Cloud Secrets
Pasted during code debugging, Cursor AI sessions & CI/CD reviews.
Instant cloud exploit. Detects OpenAI, AWS, GitHub, Stripe, and generic high-entropy API key strings before network transit.
Dev Sanitization →Database DSNs & Passwords
Full connection strings pasted for AI-assisted SQL query optimization.
Exposes entire database cluster. Detected via scheme prefixes (postgres://, mysql://, mongodb+srv://, redis://) and sanitized in RAM.
Dev Security →JWT & Session Tokens
Pasted in auth debugging prompts, exposing live user sessions & claims.
Three-part Base64 pattern (header.payload.signature). Detected and stripped to prevent session replay and privilege escalation.
Dev Profile →IPs & Internal Hostnames
Network topology leaked via DevOps AI prompts & log analysis.
Enables infrastructure reconnaissance. ISO 27001 A.8.11 mandates data masking of internal corporate topology.
Security Profile →CVE IDs & Zero-Day Details
Unpatched CVEs pasted into AI for remediation expose active attack surfaces.
LLM training pipelines can absorb internal vulnerability status. Masked to generic tags for safe code refactoring.
Security Rules →Credit Card PANs
Support chatbot refund queries & AI-drafted chargeback reports.
Validated via Luhn algorithm. Satisfies PCI-DSS 4.0 Requirement 3.4 by preventing cardholder data from entering cloud AI buffers.
PCI-DSS Rules →IBAN & Bank Accounts
Pasted during AI-assisted payroll, wire transfers & AP invoice processing.
34-char ISO 13616 validated. Replaces direct banking details with reversible tokens for zero-leak accounting automation.
Finance Rules →Salary & Financial Figures
Payroll spreadsheets pasted into AI for compensation benchmarking.
In Underwriting profile, numerical wages are preserved while identity metadata is scrubbed. In Strict Finance, exact values are masked.
Finance Profile →Tax IDs & VAT Numbers
EIN, VAT, TIN pasted into AI for invoice generation & tax filing.
Country-specific VAT prefix patterns (GB, DE, FR, US EIN: XX-XXXXXXX). Prevents commercial fiscal data leaks.
Finance Profile →Legal Case Numbers
Litigation case IDs pasted into AI for contract analysis & brief drafts.
Protects attorney-client privilege. Sanitizes case dockets, bar IDs, and judicial citations before cloud LLM transmission.
Legal Profile →Project Codenames
M&A deal names, product codenames in AI strategy docs & board notes.
Custom Regex engine allows TEAMS administrators to enforce project codename blocklists across all employee browser extensions.
Custom Rules →NDA & Contract Clauses
Confidential terms pasted into AI for redlining & clause analysis.
Prevents trade secret invalidation under DTSA and EU Trade Secrets Directive (2016/943). Masked in RAM before AI prompt submission.
Legal Profile →Employee Performance Data
Review scores & disciplinary records pasted for AI-written feedback.
Protects compliance under GDPR Article 22 regarding automated employee evaluation and profiling decisions.
HR Rules →Top 20 Corporate PII & Secret Parameters — Regulatory Master Matrix
Machine-readable reference matrix detailing legal frameworks, risk categories, and PrivacyScrubber zero-trust token replacements.
| # | Sensitive Parameter | Category | Governing Standard | LLM Risk & Severity | PrivacyScrubber Token | Recommended Profile |
|---|---|---|---|---|---|---|
| 01 | Full Names | Personal/PHI | GDPR Art. 4 / HIPAA §164.514 | Critical | [NAME_N] | General / HR |
| 02 | Email Addresses | Personal/CRM | GDPR Art. 4(1) / CCPA | High | [EMAIL_N] | General PII |
| 03 | Phone Numbers | Personal/Support | HIPAA §164.514(D) | Medium | [PHONE_N] | General PII |
| 04 | Dates of Birth | PHI / Medical | HIPAA Safe Harbor (C) | Critical | [DATE_N] | Healthcare (PHI) |
| 05 | SSN & National IDs | Critical PII | GDPR Art. 87 / HIPAA (G) | Critical | [ID_N] | Underwriting / HR |
| 06 | Medical Record Numbers | PHI / Clinical | HIPAA §164.514(H) | Critical | [MRN_N] | Healthcare (PHI) |
| 07 | Insurance & Plan IDs | PHI / Billing | HIPAA §164.514(I) | High | [INSID_N] | Healthcare (PHI) |
| 08 | API Keys & Tokens | DevOps Secrets | SOC 2 CC6.7 / ISO 27001 | Catastrophic | [API_KEY] | DevOps / Tech |
| 09 | Database DSNs & Passwords | DevOps Secrets | SOC 2 CC6.7 / ISO 27001 | Catastrophic | [DB_URL] | DevOps / Tech |
| 10 | JWT & Bearer Tokens | Auth Sessions | ISO 27001 A.8.11 | High | [JWT_N] | DevOps / Tech |
| 11 | IPs & Hostnames | Infrastructure | ISO 27001 A.8.11 | Medium | [IP_N] | Security / DevOps |
| 12 | CVE IDs & Vuln Details | Threat Intel | SOC 2 CC7.1 | High | [CVE_N] | Security / DevOps |
| 13 | Credit Card PANs | Payment Data | PCI-DSS 4.0 Req 3.4 | Catastrophic | [CARD_N] | Finance / General |
| 14 | IBAN & Bank Accounts | Banking Data | PSD2 / ISO 13616 | High | [IBAN_N] | Finance / Underwriting |
| 15 | Salary & Compensation | Payroll Data | GDPR Art. 88 / HR Laws | Medium | [BALANCE_N] | Finance / HR |
| 16 | Tax IDs & VAT Numbers | Fiscal Data | GDPR Art. 87 / Tax Code | Medium | [TAX_N] | Finance / Underwriting |
| 17 | Legal Case IDs & Dockets | Litigation IP | Attorney-Client Privilege | High | [CASEID_N] | Legal |
| 18 | Project Codenames & M&A | Trade Secret | DTSA / EU Directive 2016/943 | High | [CODE_N] | Custom / TEAMS |
| 19 | NDA & Contract Clauses | Trade Secret | Contractual Confidentiality | High | [CLAUSE_N] | Legal |
| 20 | Employee Performance Data | HR Sensitive | GDPR Art. 22 (Profiling) | Medium | [SCORE_N] | HR / Recruitment |
This exact zero-trust masking engine runs across ANY web page
Whether you are drafting sensitive emails in Gmail, prompting Copilot Workspace, debugging in Cursor, or chatting on ChatGPT & Claude — PrivacyScrubber intercepts and masks PII in local V8 RAM before a single HTTP byte leaves your device.
What Happens When Raw Data Hits AI Servers
Compare maximum statutory fines against PrivacyScrubber's zero-cost client-side protection.
GDPR Article 5(1)(c) mandates data minimisation. Transferring unmasked customer identities or sensitive records to third-party AI models requires a lawful basis, processor terms, and transfer safeguards. Client-side sanitization enforces data minimisation at the point of entry.
Why Proxy DLP Fails for AI — And Why Client-Side Masking Protects You Instantly
Traditional cloud DLP proxies route every prompt through an external gateway server. This adds latency to AI responses, creates a central honeypot for hackers, and requires months of procurement reviews. PrivacyScrubber scrubs data right inside the browser before any HTTP packet leaves your screen — 0ms latency, 0 server hops, 0 data retention risk.
By replacing sensitive entities with reversible tokens locally in browser RAM, prompts sent to ChatGPT, Claude, or Gemini contain zero raw identities. You meet GDPR Article 5(1)(c), HIPAA Safe Harbor (18 PHI identifiers), PCI-DSS 4.0 Req 3.4, and SOC 2 CC6.7 without changing how your employees work.
PrivacyScrubber v2.0.0 — 100% client-side PII masker. Zero server logs, zero cloud dependencies. 24+ specialized profiles: Healthcare (Safe Harbor 18 PHI), DevOps (API keys, JWT, IPv4/6), Legal (Case dockets), Finance (Luhn PAN, IBAN), HR (Payroll, SSN), Loan Underwriting (W-2 & Paystubs). Corpus index: /llms-full.txt.
How to Sanitize Corporate Data for AI
Exact answers to common enterprise queries — with links to live guides.
