Social Security Numbers (SSN)

Filter

This filter identifies US Social Security Numbers (SSN) such as 123-45-6789 and 123456789 in text.

A value in the form NN-NNNNNNN (two digits, a hyphen, then seven digits) is an Employer Identification Number and is not reported by this filter; use the EIN filter to detect it.

An SSN-shaped value beginning with 9 is never reported by this filter. Those values are Individual Taxpayer Identification Numbers; use the ITIN filter to detect them.

Separators

Between the digit groups of an SSN the filter accepts a hyphen, a single horizontal whitespace character (a space, a tab, or a non-breaking space), or nothing at all. In place of the ASCII hyphen it also accepts the soft hyphen (U+00AD), the dashes U+2010 through U+2015 (which include the non-breaking hyphen U+2011), the minus sign (U+2212), and the small and fullwidth hyphen-minus forms (U+FE58, U+FE63, U+FF0D).

Both separators must be the same kind: both hyphens, both single whitespace characters, or both absent. So 123-45-6789, 123 45 6789, and 123456789 are detected, but 123-456789, 12345-6789, and 123 45-6789 are not. This keeps a ZIP+4 code such as 52168-1208 from being reported as an SSN. The two hyphens may be different hyphen characters, such as an ASCII hyphen and a non-breaking hyphen. The ITIN and Canadian SIN filters follow the same rule.

An identifier wrapped across a line break is detected when the break follows a hyphen:

SSN: 078-05-
1120

Indentation on the continuation line is allowed. The span covers the whole identifier, line break included, and its offsets index into the original text, since the input is not normalized before matching.

The following are not detected:

• A line break that no hyphen precedes, so digits on separate lines are not joined into an identifier.
• A break inside a digit group, such as 078-05-11 followed by 20 on the next line.
• Digits outside ASCII, such as fullwidth or Arabic-Indic digits.
• More than one whitespace character between groups.

When splitting is enabled with the newline method, a wrapped identifier falls across two pieces and is not detected at the default overlap of 0. Set an overlap at least as long as the identifier to keep it detectable.

Required Parameters

This filter has no required parameters.

Optional Parameters

Parameter	Description	Default Value
ssnFilterStrategies	A list of filter strategies.	None
enabled	When set to false, the filter will be disabled and not applied	true
ignored	A list of terms to be ignored by the filter.	None
windowSize	Sets the size of the window (in terms) surrounding a span to look for contextual terms. If set, this value overrides the value of span.window.size in the configuration.	The value of span.window.size which is by default 5.
priority	The priority (integer) of this filter. Valid values are any positive integer, where a higher value indicates a higher priority. Priority is used for tie-breaking when two spans may be otherwise identical.	0

Filter Strategies

The filter may have zero or more filter strategies. When no filter strategy is given the default strategy of REDACT is used. When multiple filter strategies are given the filter strategies will be applied in order as they are listed. See Filter Strategies for details.

Strategy	Description
REDACT	Replace the sensitive text with a placeholder.
MASK	Replace each character of the sensitive text with a mask character (* by default).
TRUNCATE	Replace all but a few characters of the sensitive text with a truncation character (* by default).
RANDOM_REPLACE	Replace the sensitive text with a similar, random value.
STATIC_REPLACE	Replace the sensitive text with a given value.
CRYPTO_REPLACE	Replace the sensitive text with its encrypted value.
HASH_SHA256_REPLACE	Replace the sensitive text with its SHA256 hash value.
FPE_ENCRYPT_REPLACE	Replace the sensitive text with a value generated by format-preserving encryption (FPE)
LAST_4	Replace the sensitive text with just the last four characters of the text.

Conditions

Each filter strategy may have one condition. See Conditions for details.

Conditional	Description	Operators
TOKEN	Compares the value of the sensitive text.	==, !=, startswith
CONTEXT	Compares the filtering context.	== , !=
CONFIDENCE	Compares the confidence in the sensitive text against a threshold value.	< , <=, > , >=, ==, !=

Example Policy

{
   "identifiers": {
      "ssn": {
         "ssnFilterStrategies": [
            {
               "strategy": "REDACT",
               "redactionFormat": "{{{REDACTED-%t}}}"
            }
         ]
      }
   }
}