Sensitive fields

Some customer data shouldn’t reach an AI agent or every teammate: a tax ID, a card’s last digits, a home address. Mark those fields sensitive and Boom hides their values. Nothing is sensitive until you mark it. This page is the reference. For a step-by-step guide to hiding fields in the dashboard, see Hide sensitive customer data. A hidden value is still stored and keeps working: segments still filter on it and messages can still use it. What changes is who can read it.

Who reads	What they see
AI agents (in conversations, the in-app assistant, MCP tools)	`[redacted]` in place of the value, always
Teammates whose role can see sensitive data (Owner, Admin, Developer)	The value
Everyone else in your organization	A Hidden marker instead of the value, except the screens listed below

Exports. A segment CSV export by someone who can’t see sensitive data is refused with hidden_fields while any contact field is hidden. Initiative participant exports write [redacted] in place of a hidden name or phone. Inbox. The conversation list, header and customer panel follow the same rules. One difference: a hidden phone shows its last four digits in the conversation list and header (•••• 0100), so teammates can tell conversations apart. See What your teammates see. Not covered yet for teammates. These screens still show the real value to teammates who can open them:

An initiative’s Contacts tab.
Pending enrollment requests in the agent tester’s Run as picker.
Computed segment columns whose formula reads a hidden field.
The inbox’s New message contact picker.
The caller’s name when an incoming WhatsApp call rings.
A customer’s Instagram @username in the inbox customer panel.
Message text, in either direction: messages stay as written, including a template variable filled in from a hidden field.

What you can mark

Contact fields every person has: email, phone number, first name and last name. The external ID can’t be hidden, because Boom uses it to match people across your systems. First and last name are hidden separately: hide only the last name and agents see Ana [redacted], teammates see “Ana” with a Hidden marker. A stored full name we can’t split safely, such as a WhatsApp profile name, is hidden whole.
People attributes: any key in your people attribute catalog.
Custom object attributes: any key in a custom object type’s catalog. A hidden attribute with nested data (an object or a list) is hidden whole.

Marking a contact field doesn’t mark an attribute that copies it (an email attribute beside the built-in email). Settings suggests those copies so you can hide them too. A new attribute from a sync starts visible, and a sync never changes what you’ve hidden.

Where to mark fields

Settings › Sensitive data in the dashboard. Owners and Admins can change it; other roles with access to settings see it read-only.
The REST API: GET and POST /api/v1/cdp/sensitive-fields. Up to 100 changes per call, applied all or nothing: an unknown field fails the whole call.
MCP: the same tools, cdp_sensitive_fields_get and cdp_sensitive_fields_set. A connected AI tool can only hide a field. Asking it to make one visible again returns sensitive_unmark_forbidden; do that in Settings or with the REST API.

POST /api/v1/cdp/sensitive-fields
{
  "changes": [
    { "scope": "built_in", "field": "PHONE_NUMBER", "isSensitive": true },
    { "scope": "people", "key": "rfc", "isSensitive": true },
    { "scope": "custom_object", "type": "order", "key": "card_last4", "isSensitive": true }
  ]
}

Known limitations

An agent that reads a segment or journey definition sees its filters as they were written. If a teammate built a filter on a hidden field, the value typed into that filter is visible to the agent.
External IDs can’t be hidden, and agents can look people up by part of an external ID.

Sensitive data is turned on per workspace. Ask Boom to enable it for yours. Until then, marking fields returns sensitive_data_unavailable; reading the list always works.

Overview

People

Custom objects

Events

Relationships

Types