> ## Documentation Index
> Fetch the complete documentation index at: https://docs.useboom.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Hide sensitive customer data

> Choose which customer fields your AI agents and teammates without access can't read, from Settings › Sensitive data.

Some customer data shouldn't reach an AI agent or every person on your team: a
tax ID, the last digits of a card, a home address. In Boom you mark those
fields **Hidden**. The value stays stored and keeps working, but agents read
`[redacted]` in its place and teammates without access see a **Hidden** lock.

Nothing is hidden until you hide it.

<Note>
  Sensitive data is turned on per workspace. Ask Boom to enable it for yours.
  Until then, the settings page doesn't appear and the API answers
  `sensitive_data_unavailable` when you try to hide a field.
</Note>

<Tip>
  Looking for how to keep parts of **your own app** out of what the web
  widget's in-app expert reads? That's a different feature:
  [Protecting sensitive data](/protecting-sensitive-data).
</Tip>

## Hide a field

1. Go to **Settings › Sensitive data**.
2. Find the field. The page has three sections:
   * **Built-in fields**: email, phone number, first name and last name, the
     contact fields every person has.
   * **People attributes**: extra fields from your integrations and imports.
     Search by key, or filter by **Hidden** or **Looks personal**.
   * **Custom objects**: fields on records like orders, policies or accounts.
3. Turn on its switch. The field is hidden right away; there's nothing to save.

To show a field again, turn its switch off. Boom asks you to confirm, because
agents and teammates without access can read it again from their next message.

**External ID can't be hidden.** Boom uses it to match people across your
systems.

### Hide the copies too

Hiding a built-in field doesn't hide an attribute that holds the same data,
such as an `email` attribute next to the built-in email. When you hide a
built-in, Boom lists attributes that look like copies of it. Choose **Hide
these too** to hide them in one step, or **Not now** to leave them visible.

New attributes from a sync start visible, and a sync never changes what you've
hidden.

### Who can change it

Only **Owners** and **Admins** can hide or show fields. Other roles that can
open settings see the page read-only.

## What your agents see

Every AI agent in Boom (the agent in your conversations, voice calls, the
in-app assistant, and AI tools connected over MCP) gets `[redacted]` in place
of a hidden value. The agent knows the field exists, so it never asks the
customer to repeat it and never tries to guess it. If it needs the value, it
escalates to your team.

One exception: in a conversation, the agent still knows the name of the person
it's talking to, so it can greet them. Hiding names hides them everywhere else,
including when an agent looks up or reads about other customers.

An agent also can't work out a hidden value indirectly. If it tries to filter,
group or list the distinct values of a hidden field, Boom refuses.

First and last name are hidden separately. Hide only the last name and agents
see `Ana [redacted]`. A stored full name Boom can't split safely, such as a
WhatsApp profile name, is hidden whole.

## What your teammates see

| Role | What they see |
| - | - |
| Owner, Admin, Developer | The value |
| Everyone else | A **Hidden** lock instead of the value |

You can see the full list on **Settings › Organization › Roles**, in the
**Sensitive data (hidden fields)** row.

With only the last name hidden, teammates without access see "Ana" with a
**Hidden** lock next to it.

This includes the drawer for a single run: its header, the run's stored data
on the **Data** tab (including computed attributes built from a hidden field)
and the details of each step on the **Activity** tab. A customer reply quoted on
the **Activity** tab is part of the conversation and stays visible, like the
conversation itself.

### In the inbox

The same rules apply to the conversation list, the conversation header, and
the customer panel for teammates without access:

* **Name**: a hidden last name shows "Ana" with the lock. A fully hidden name
  shows the customer's phone or email instead, if those are visible, or the
  lock.
* **Phone** in the conversation list and header: only the last four digits
  are shown, for example `•••• 0100`, so your team can still tell
  conversations apart. In the customer panel, a hidden phone shows the lock.
* **Email** in the customer panel: the lock.
* **Extra contact info** added to a customer (a second phone or email) follows
  the same setting as the customer's own phone or email.
* **Search** still finds a conversation by a hidden name or number, but the
  results show it hidden. Because search still matches, a teammate can confirm
  a guess: typing a number they suspect and seeing the conversation come up,
  or comparing it with the last four digits shown, tells them they were right.
* **Notifications** for new messages show the hidden name the same way.
* **Settings › Logs** and **Agent Studio** show message recipients and
  customers the same way.
* A customer name that is really an email address or phone number (for
  example from a guest checkout) is hidden along with that email or phone.

**Message content stays as written.** Hiding a field never changes the text of
a message: neither what customers write nor what is sent to them (AI replies,
templates, and your teammates' messages). If a message contains a hidden
value, teammates can read it in the conversation.

Replying and sending templates keep working. If a template variable is filled
in from a hidden field, the inbox shows it as hidden while you prepare the
message, and Boom sends the real value. The sent message then shows what was
sent, like any other message text.

## What keeps working

Hiding a field changes who can **read** it, not how Boom uses it.

* **Segments** you build in the dashboard can still filter on hidden fields.
* **Journeys** can still send a hidden field in a message. The builder warns
  you, because sending it puts the value somewhere new:

  * `SENSITIVE_FIELD_SENT`: a message (WhatsApp, SMS, email, Instagram,
    Messenger) puts the value in the conversation, where the agent and inbox
    users can read it.
  * `SENSITIVE_FIELD_SENT_EXTERNAL`: an HTTP request sends it to an external
    URL.
  * `SENSITIVE_FIELD_MAPPED`: a route-to-initiative step copies it into
    another initiative's context.

  These are warnings only. They never block publishing.

## Exports

* A **segment CSV export** by someone who can't see hidden values is refused
  with `hidden_fields` while any built-in field is hidden.
* **Initiative participant exports** write `[redacted]` in place of a hidden
  name or phone for people without access.

## Hide fields with the API or MCP

You can also hide fields with the REST API (`GET` and `POST
/api/v1/cdp/sensitive-fields`) or from an AI tool connected over
[MCP](/use-mcp). An AI tool can only **hide** a field, never show one again.
See [Sensitive fields](/cdp/sensitive-fields) for the request format and the
full reference.

## Not covered yet

A few screens still show the real value to teammates who can open them:

* An initiative's **Contacts** tab.
* Pending enrollment requests in the agent tester's **Run as** picker.
* Computed segment columns whose formula reads a hidden field.
* The inbox's **New message** contact picker.
* The caller's name when an incoming WhatsApp call rings.
* A customer's **Instagram @username** in the inbox customer panel.
* Message text, in either direction: messages stay as written, including a
  template variable filled in from a hidden field.

For what an agent can still see, such as the values typed into an existing
segment filter, see [Known limitations](/cdp/sensitive-fields#known-limitations).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.