Redact
Redaction replaces each selected finding with an unnumbered entity placeholder.jane@example.com becomes [EMAIL].
Mask
Masking replaces every non-revealed Unicode code point. The default character is*. A custom character must be exactly one non-whitespace, non-control
Unicode code point.
Remove
Removal deletes only the exact finding span. It does not normalize adjacent whitespace.Pseudonymize
Pseudonymization computes deterministic HMAC-SHA-256 over the exact UTF-8 matched value using a provider-resolved 32-byte key. Use it when stable equality under an intentionally scoped secret key is required. See Pseudonymization.Tokenize
Tokenization asks an application-owned provider to issue opaque token payloads. The resulting envelope can later be restored under the same exact request scope. See Tokenization and restoration.Transformation records
Each applied replacement produces a record with:- source ranges and detector provenance;
- the strategy and exact replacement;
- output ranges that select the replacement;
- resolved key metadata for pseudonymization; or
- resolved token metadata for tokenization.
matched_text or a plaintext-to-token mapping.