> ## Documentation Index
> Fetch the complete documentation index at: https://docs.useboom.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Sensitive fields

> Hide customer data fields from AI agents and from teammates without access.

Some customer data shouldn't reach an AI agent or every teammate: a tax ID, a
card's last digits, a home address. Mark those fields **sensitive** and Boom
hides their values. Nothing is sensitive until you mark it.

This page is the reference. For a step-by-step guide to hiding fields in the
dashboard, see [Hide sensitive customer data](/hide-sensitive-data).

A hidden value is **still stored** and keeps working: segments still filter on
it and messages can still use it. What changes is who can **read** it.

| Who reads | What they see |
| - | - |
| AI agents (in conversations, the in-app assistant, MCP tools) | `[redacted]` in place of the value, always |
| Teammates whose role can see sensitive data (Owner, Admin, Developer) | The value |
| Everyone else in your organization | A **Hidden** marker instead of the value, except the screens listed below |

**Exports.** A segment CSV export by someone who can't see sensitive data is
refused with `hidden_fields` while any contact field is hidden. Initiative
participant exports write `[redacted]` in place of a hidden name or phone.

**Inbox.** The conversation list, header and customer panel follow the same
rules. One difference: a hidden phone shows its last four digits in the
conversation list and header (`•••• 0100`), so teammates can tell
conversations apart. See
[What your teammates see](/hide-sensitive-data#in-the-inbox).

**Not covered yet for teammates.** These screens still show the real value to
teammates who can open them:

* An initiative's **Contacts** tab.
* Pending enrollment requests in the agent tester's **Run as** picker.
* Computed segment columns whose formula reads a hidden field.
* The inbox's **New message** contact picker.
* The caller's name when an incoming WhatsApp call rings.
* A customer's Instagram @username in the inbox customer panel.
* Message text, in either direction: messages stay as written, including a
  template variable filled in from a hidden field.

## What you can mark

* **Contact fields** every person has: email, phone number, first name and last
  name. The external ID can't be hidden, because Boom uses it to match people
  across your systems. First and last name are hidden separately: hide only the
  last name and agents see `Ana [redacted]`, teammates see "Ana" with a
  **Hidden** marker. A stored full name we can't split safely, such as a
  WhatsApp profile name, is hidden whole.
* **People attributes**: any key in your people attribute catalog.
* **Custom object attributes**: any key in a custom object type's catalog. A
  hidden attribute with nested data (an object or a list) is hidden whole.

Marking a contact field doesn't mark an attribute that copies it (an `email`
attribute beside the built-in email). Settings suggests those copies so you can
hide them too.

A new attribute from a sync starts visible, and a sync never changes what
you've hidden.

## Where to mark fields

* **Settings › Sensitive data** in the dashboard. Owners and Admins can change
  it; other roles with access to settings see it read-only.
* The [REST API](/api-reference/overview): `GET` and `POST
  /api/v1/cdp/sensitive-fields`. Up to 100 changes per call, applied all or
  nothing: an unknown field fails the whole call.
* [MCP](/use-mcp): the same tools, `cdp_sensitive_fields_get` and
  `cdp_sensitive_fields_set`. A connected AI tool can only **hide** a field.
  Asking it to make one visible again returns `sensitive_unmark_forbidden`; do
  that in Settings or with the REST API.

```json theme={null}
POST /api/v1/cdp/sensitive-fields
{
  "changes": [
    { "scope": "built_in", "field": "PHONE_NUMBER", "isSensitive": true },
    { "scope": "people", "key": "rfc", "isSensitive": true },
    { "scope": "custom_object", "type": "order", "key": "card_last4", "isSensitive": true }
  ]
}
```

## Known limitations

* An agent that reads a segment or journey definition sees its filters as
  they were written. If a teammate built a filter on a hidden field, the
  value typed into that filter is visible to the agent.
* External IDs can't be hidden, and agents can look people up by part of an
  external ID.

<Note>
  Sensitive data is turned on per workspace. Ask Boom to enable it for yours.
  Until then, marking fields returns `sensitive_data_unavailable`; reading the
  list always works.
</Note>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.