Employer Identification Numbers (EIN)

Filter

This filter identifies US Employer Identification Numbers (EIN), the federal tax ID, in the canonical form NN-NNNNNNN (two digits, a hyphen, then seven digits) such as 12-3456789.

Only the hyphenated form is detected. A bare nine-digit run is ambiguous with an SSN and is not claimed as an EIN; the hyphen after the second digit is what distinguishes an EIN from an SSN (whose canonical form hyphenates after the third and fifth digits). This is the only filter that detects the NN-NNNNNNN form: the SSN filter does not, so a policy must enable ein to detect EINs.

Separators

In place of the ASCII hyphen the filter also accepts the soft hyphen (U+00AD), the dashes U+2010 through U+2015 (which include the non-breaking hyphen U+2011), the minus sign (U+2212), and the small and fullwidth hyphen-minus forms (U+FE58, U+FE63, U+FF0D), the same hyphens the SSN filter accepts.

An EIN wrapped across a line break is detected when the break follows the hyphen:

EIN: 12-
3456789

Indentation on the continuation line is allowed. The span covers the whole EIN, line break included, and its offsets index into the original text, since the input is not normalized before matching.

The following are not detected:

An EIN inside a longer token joined by hyphens, such as 45-6789123 in 123-45-6789123-45-6789 or 12-1234567 in 12-1234567-8. A hyphen next to the start or end of a match (the ASCII hyphen, the soft hyphen, U+2010 through U+2012, the minus sign, or the small or fullwidth hyphen-minus) counts as part of a longer token, as a letter or digit does. An en dash, em dash, horizontal bar, or small em dash next to an EIN is treated as punctuation, so an EIN followed directly by an em dash (U+2014), or a range of two EINs joined by an en dash (U+2013), is still detected.
A line break that no hyphen precedes, or a break inside the seven digits.
Digits outside ASCII, such as fullwidth or Arabic-Indic digits.

When splitting is enabled with the newline method, a wrapped EIN falls across two pieces and is not detected at the default overlap of 0. Set an overlap at least as long as the EIN to keep it detectable.

Required Parameters

This filter has no required parameters.

Optional Parameters

Parameter	Description	Default Value
`einFilterStrategies`	A list of filter strategies.	None
`onlyValidPrefixes`	When `true`, only detect EINs whose two-digit prefix is one the IRS currently issues. This reduces false positives on format-valid but non-issued numbers. A prefix added by the IRS after this release is recognized only once the engine's prefix list is updated.	`false`
`enabled`	When set to false, the filter will be disabled and not applied	`true`
`ignored`	A list of terms to be ignored by the filter.	None
`windowSize`	Sets the size of the window (in terms) surrounding a span to look for contextual terms. If set, this value overrides the value of `span.window.size` in the configuration.	The value of `span.window.size` which is by default `5`.
`priority`	The priority (integer) of this filter. Valid values are any positive integer, where a higher value indicates a higher priority. Priority is used for tie-breaking when two spans may be otherwise identical.	`0`

Filter Strategies

The filter may have zero or more filter strategies. When no filter strategy is given the default strategy of REDACT is used. When multiple filter strategies are given the filter strategies will be applied in order as they are listed. See Filter Strategies for details.

Strategy	Description
`REDACT`	Replace the sensitive text with a placeholder.
`MASK`	Replace each character of the sensitive text with a mask character (`*` by default).
`TRUNCATE`	Replace all but a few characters of the sensitive text with a truncation character (`*` by default).
`RANDOM_REPLACE`	Replace the sensitive text with a similar, random value.
`STATIC_REPLACE`	Replace the sensitive text with a given value.
`CRYPTO_REPLACE`	Replace the sensitive text with its encrypted value.
`HASH_SHA256_REPLACE`	Replace the sensitive text with its SHA256 hash value.
`FPE_ENCRYPT_REPLACE`	Replace the sensitive text with a value generated by format-preserving encryption (FPE)
`LAST_4`	Replace the sensitive text with just the last four characters of the text.

Conditions

Each filter strategy may have one condition. See Conditions for details.

Conditional	Description	Operators
`TOKEN`	Compares the value of the sensitive text.	`==`, `!=`, `startswith`
`CONTEXT`	Compares the filtering context.	`==` , `!=`
`CONFIDENCE`	Compares the confidence in the sensitive text against a threshold value.	`<` , `<=`, `>` , `>=`, `==`, `!=`

Example Policy

{
   "identifiers": {
      "ein": {
         "onlyValidPrefixes": true,
         "einFilterStrategies": [
            {
               "strategy": "REDACT",
               "redactionFormat": "{{{REDACTED-%t}}}"
            }
         ]
      }
   }
}

The ein filter requires redaction policy schema 1.2.0.