Employer Identification Numbers (EIN)

Filter

This filter identifies values in the form of US Employer Identification Numbers (EIN), the federal tax ID for businesses, and reports them with the span type ein. It detects the hyphenated form NN-NNNNNNN, two digits, a hyphen, and seven digits, such as 12-3456789.

A bare nine-digit number is not reported as an EIN, since it cannot be told apart from an SSN; the hyphen after the second digit is what marks an EIN. This is the only filter that detects the NN-NNNNNNN form: the SSN filter does not, so a policy must enable ein to detect EINs.

Detection is based on the format of the value, so a number in this form that is not an EIN can be reported. Setting onlyValidPrefixes reduces this. Validate the results against your own documents.

Separators and line breaks

In place of the ASCII hyphen the filter also accepts the soft hyphen (U+00AD), the dashes U+2010 through U+2015, the minus sign (U+2212), and the small and fullwidth hyphen-minus forms (U+FE58, U+FE63, U+FF0D), the same hyphens the SSN filter accepts. An EIN wrapped across a line break is detected when the break follows the hyphen, such as 12- at the end of one line followed by 3456789 on the next.

Not detected: an EIN inside a longer token joined by hyphens, such as 45-6789123 in 123-45-6789123-45-6789; a line break that no hyphen precedes, or a break inside the seven digits; and digits outside ASCII (such as fullwidth digits). An en dash or em dash next to an EIN is treated as punctuation, so an EIN followed directly by an em dash is still detected.

Required Parameters

This filter has no required parameters.

Optional Parameters

Parameter	Description	Default Value
einFilterStrategies	A list of filter strategies.	None
onlyValidPrefixes	When true, only report EINs whose two-digit prefix is one the IRS currently issues. This reduces false positives on numbers in the EIN format that were never issued. A prefix the IRS adds after this release of Philter is not recognized.	false
enabled	When set to false, the filter will be disabled and not applied	true
ignored	A list of terms to be ignored by the filter.	None

Filter Strategies

The filter may have zero or more filter strategies. When no filter strategy is given the default strategy of REDACT is used. When multiple filter strategies are given, they are evaluated in the order listed and only the first one whose condition is satisfied, or that has no condition, is applied. See Filter Strategies for details.

Strategy	Description
REDACT	Replace the sensitive text with a placeholder.
MASK	Replace each character of the sensitive text with a mask character (* by default).
TRUNCATE	Replace all but a few characters of the sensitive text with a truncation character (* by default).
RANDOM_REPLACE	Replace the sensitive text with a similar, random value.
STATIC_REPLACE	Replace the sensitive text with a given value.
CRYPTO_REPLACE	Replace the sensitive text with its encrypted value.
HASH_SHA256_REPLACE	Replace the sensitive text with its SHA256 hash value.
FPE_ENCRYPT_REPLACE	Replace the sensitive text with a value generated by format-preserving encryption (FPE)
LAST_4	Replace the sensitive text with just the last four characters of the text.

Conditions

Each filter strategy may have one condition. See Conditions for details.

Conditional	Description	Operators
TOKEN	Compares the value of the sensitive text.	==, !=, startswith
CONTEXT	Compares the filtering context.	== , !=
CONFIDENCE	Compares the confidence in the sensitive text against a threshold value.	< , <=, > , >=, ==, !=

Example Policy

{
   "identifiers": {
      "ein": {
         "onlyValidPrefixes": true,
         "einFilterStrategies": [
            {
               "strategy": "REDACT",
               "redactionFormat": "{{{REDACTED-%t}}}"
            }
         ]
      }
   }
}