---
title: "PII and Data Scrubbing"
description: "This document describes a configuration format that we would like to hide from the user eventually. The only reason this page still exists is, because currently Relay accepts this format in alternative to regular data scrubbing settings."
url: https://develop.sentry.dev/backend/application-domains/pii/
---

# PII and Data Scrubbing

The following document explores the syntax and semantics of the configuration for [Advanced Data Scrubbing](https://docs.sentry.io/product/data-management-settings/scrubbing/advanced-datascrubbing/) consumed and executed by [Relay](https://github.com/getsentry/relay). Sometimes, this is also referred to as PII scrubbing.

## [A Basic Example](https://develop.sentry.dev/backend/application-domains/pii.md#a-basic-example)

Say you have an exception message which, unfortunately, contains IP addresses which are not supposed to be there. You'd write:

```json
{
  "applications": {
    "$string": ["@ip:replace"]
  }
}
```

It reads as "replace all IP addresses in all strings", or "apply `@ip:replace` to all `$string` fields".

`@ip:replace` is called a rule, and `$string` is a [selector](https://develop.sentry.dev/backend/pii/selectors.md).

## [Built-in Rules](https://develop.sentry.dev/backend/application-domains/pii.md#built-in-rules)

The following rules exist by default:

* `@ip:replace` and `@ip:hash` for replacing IP addresses.
* `@imei:replace` and `@imei:hash` for replacing IMEIs
* `@mac:replace`, `@mac:mask` and `@mac:hash` for matching MAC addresses
* `@email:mask`, `@email:replace` and `@email:hash` for matching email addresses
* `@creditcard:mask`, `@creditcard:replace` and `@creditcard:hash` for matching creditcard numbers
* `@userpath:replace` and `@userpath:hash` for matching local paths (e.g. `C:/Users/foo/`)
* `@password:remove` for removing passwords. In this case we're pattern matching against the field's key, whether it contains `password`, `credentials` or similar strings.
* `@anything:remove`, `@anything:replace` and `@anything:hash` for removing, replacing or hashing any value. It is essentially equivalent to a wildcard-regex, but it will also match much more than strings.

## [Writing Your Own Rules](https://develop.sentry.dev/backend/application-domains/pii.md#writing-your-own-rules)

Rules generally consist of two parts:

* *Rule types* describe what to match. See [PII Rule Types](https://develop.sentry.dev/backend/pii/types.md) for an exhaustive list.
* *Rule redaction methods* describe what to do with the match. See [PII Redaction Methods](https://develop.sentry.dev/backend/pii/methods.md) for a list.

Each page comes with examples. Try those examples out by pasting them into the "PII config" column of [Piinguin](https://getsentry.github.io/piinguin) and clicking on fields to get suggestions.

## [Interactive Editing](https://develop.sentry.dev/backend/application-domains/pii.md#interactive-editing)

The easiest way to go about this is if you already have a raw JSON payload from some SDK. Go to our PII config editor [Piinguin](https://getsentry.github.io/piinguin), and:

1. Paste in a raw event
2. Click on data you want eliminated
3. Paste in other payloads and see if they look fine, go to step **2** if necessary.

## Pages in this section

- [PII Redaction Methods](https://develop.sentry.dev/backend/application-domains/pii/methods.md)
- [PII Rule Types](https://develop.sentry.dev/backend/application-domains/pii/types.md)
- [PII Selectors](https://develop.sentry.dev/backend/application-domains/pii/selectors.md)