Masking sensitive data in Xtendis 7

Info: This feature requires Xtendis 7.3.9 or higher (see how to check the version number of Xtendis that you are using).

Documents from customers that are added to Xtendis can contain sensitive, private data such as bank account numbers (IBAN), social security numbers (SSN, BSN, NINO), credit card numbers, and so on.

Xtendis can detect this information and (depending on configuration), take one of the following actions:

• Automatically mask the information. Sensitive information is immediately obscured within the document.
• Flag the hits for review. Using manual validation workflows, users can verify the found results before masking.
• Set a metadata property. Documents can be marked with metadata that indicates the presence and type of the detected data, without modifying the original content.

How it works

In short, the process is as follows:

• The process takes place in the background during file upload, or by verifying documents that already exist in the system.
• Detection is based on predefined patterns or custom-configured rules using regular expressions (regex).
• Organizations can define their own detection rules, thereby ensuring adaptability to industry-specific requirements or internal policies.
• Common identifiers are used, which are extensible.

For added transparency, an overview can be generated that outlines all identified risk elements, including a textual summary that lists where (including on which pages) sensitive data appears. This provides clear insight into exposure without exposing the original content.

How the process should function is configured in the system. For more information, contact your WoodWing representative.

How the original file is treated

Info: This feature requires Xtendis 7.3.18 or higher (see how to check the version number of Xtendis that you are using).

When a document is masked, the following options are available to determine what happens to the original unmasked file:

• Keep the file. The original file remains in its current location, accessible to users with the appropriate permissions. Use this when the unmasked version still has legitimate value and access is already sufficiently controlled.

• Move the file to a security zone. The original file is relocated to a security zone with more restricted access rights. Use this when the unmasked version must be retained for audit or legal purposes, but should no longer be reachable by the same audience as the masked copy.

• Delete the file. The original file is permanently removed after the masked version is created. Use this when retention of the unmasked document is not required and minimizing exposure is the priority.