What euRedact detects /

A government-issued personal identification number assigned to a specific natural person by a national authority and used as a primary identity reference. Covers the Belgian Rijksregisternummer, Dutch BSN, French NIR, Spanish DNI and NIE, Polish PESEL, Swedish personnummer, Danish CPR, Norwegian fødselsnummer, Finnish HETU, Icelandic kennitala, Estonian isikukood, Latvian personas kods, Lithuanian asmens kodas, Bulgarian ЕГН, Romanian CNP, Greek AMKA, Slovenian EMŠO, Hungarian személyi szám, Czech and Slovak rodné číslo, Maltese and Cypriot ID card numbers, and the Luxembourg matricule — among others. Historic formats count alongside current ones. Most carry a checksum, and the engine validates it rather than trusting shape alone.

Does not cover: Purely fiscal identifiers (TAX_ID), health-fund numbers (HEALTH_INSURANCE), separate social-security numbers (SSN), passport, driving licence or residence-permit numbers, VAT numbers, company registration numbers, or internal customer and employee references (INTERNAL_ID).

Where a country's national ID doubles as its tax identifier — the Italian Codice Fiscale, Croatian OIB, Portuguese NIF, Spanish DNI in fiscal use — the broader identity role wins. Where an identifier encodes a birth date (BSN, CPR, PESEL, fødselsnummer), the whole value is one NATIONAL_ID; the embedded date is not additionally reported as a date of birth.

The document number printed on a passport or equivalent international travel document, including diplomatic, service and emergency travel documents. Identifies the physical document and, through it, the holder.

Does not cover: The holder's national ID, visa or residence-permit numbers, or the machine-readable-zone content as a whole.

Passport numbering is not standardised across issuers and carries no general checksum, so the Rules Engine layer holds context-gated patterns for a small number of jurisdictions only and the AI layer carries the rest.

A government-issued personal or entity identifier used by a tax authority to track fiscal obligations, where it is distinct from the general-purpose national ID. Validated formats include the German Steuer-ID, the Greek ΑΦΜ and the Polish NIP.

Does not cover: VAT registration numbers (VAT), company registration numbers (CHAMBER_OF_COMMERCE), national IDs that merely happen to be used fiscally (NATIONAL_ID), or customs and duty references.

A social-security identifier granting access to state social-insurance programmes — pension, unemployment, disability, parental leave, in some countries health — in jurisdictions that issue a separate social-security number rather than using the national ID for the purpose. The Irish PPSN and the German Sozialversicherungsnummer are the reference cases; US-format SSNs are also recognised.

Does not cover: National IDs that serve a social-security function (NATIONAL_ID), tax-only identifiers (TAX_ID), or health-insurance member numbers (HEALTH_INSURANCE).

The identifier on a driving licence document — national, EU-format or international.

Does not cover: The vehicle's registration plate (LICENSE_PLATE), the holder's national ID, or insurance and traffic-fine references.

A document number issued by a host country granting a non-citizen the right to enter, stay, work or study for a defined period or status. Covers residence cards, work permits, long- and short-stay visas, and asylum-seeker and refugee documentation.

Where a foreigner-identity number functions as a general identity reference in the document it is classed NATIONAL_ID; where the document explicitly concerns the residence-permit document itself, RESIDENCE_PERMIT applies.

A government or private health-fund identifier assigned to an insured person for the administration of medical coverage: health-fund member numbers, mutuality, Krankenkasse and mutuelle IDs, and health-insurance card numbers. The UK NHS number is checksum-validated.

Does not cover: The holder's national ID or social-security number, or a hospital-internal patient record number (INTERNAL_ID).

This type is the number, never the name of the insurer. An insurer's name is an organisation name.

A registration identifier issued to a healthcare provider — physician, nurse, pharmacist, dentist, allied health professional, clinic or hospital — for billing, prescribing, registration or regulatory purposes. Reference cases are the Belgian RIZIV/INAMI number, the Dutch BIG number and the German LANR.

Scoped to the identifier code. A practitioner's name is a person name; a clinic's name is an organisation name.

A bank account identifier used to route payments to or from a specific account holder: IBAN (ISO 13616, mod-97 validated), pre-IBAN domestic account numbers, and foreign equivalents.

IBANs are detected both by a generic international pattern and by country-specific ones, so a cross-border IBAN is recognised in a document from another jurisdiction.

A Bank Identifier Code (ISO 9362), also labelled “SWIFT code” or “BIC/SWIFT”: four letters for the institution, an ISO-3166 country code, two location characters and an optional three-character branch code. Both the compact and space-separated written forms are recognised.

A BIC has no check digit, and its shape — eight or eleven upper-case alphanumerics — collides with ordinary capitalised words in many European languages. Detection therefore requires registry confirmation or explicit banking context, never shape alone. It identifies the financial institution rather than the account holder, but pairs with BANK_ACCOUNT to enable routing.

A payment card primary account number — credit, debit, prepaid or charge — from Visa, Mastercard, Amex, Diners, Discover, JCB, UnionPay, Maestro and other networks, together with tightly-coupled card data: CVV/CVC, magnetic-stripe content and card PIN.

Luhn validation is what separates a card number from an invoice or order number of similar length; the AI layer resolves the remainder. Subject to PCI-DSS in addition to GDPR.

A VAT registration number issued to a business or sole trader by a member state's tax authority. Publicly searchable in most jurisdictions, and validated by checksum for several including BE, DE, FR, LU, NL and DK.

Does not cover: Personal tax identifiers (TAX_ID, NATIONAL_ID) or company registration numbers (CHAMBER_OF_COMMERCE).

A specific monetary amount in identifying context attached to a natural person: salary, compensation, settlement, account balance, debt, benefit or contract value.

Does not cover: Generic prices, market data or macroeconomic figures.

An RFC 5322 e-mail address functioning as a contact-channel identifier for an identified or identifiable person. Non-ASCII local parts, including Greek and Cyrillic, are supported.

The Rules Engine layer covers standard formats; the AI layer adds display-name forms, deliberately obfuscated forms (“name [at] domain [dot] com”), plus-tagged addresses and internationalised domains.

A telephone, mobile or fax number allowing direct contact with a person, household or organisation. Detected by 98 national-format patterns — one set for every supported country, the largest single group in the engine — plus an E.164-validated international pattern in the shared tier.

The AI layer adds short domestic formats without a country code, unusual separators and numbers embedded in prose.

A username, screen name or account identifier on a social platform, messaging service, online community or gaming network, when attached to an identifiable person. Both the canonical @handle form and the bare-word username form where context confirms it. Handles containing non-ASCII letters are supported.

A web address that, in context, identifies a specific natural person, a named organisation mentioned elsewhere in the document, or an account, profile or project page tied to an identified party.

Does not cover: URLs carrying no identifying signal — framework documentation, standards bodies, CDN assets, general public-knowledge references.

Whether a URL is personal data is a contextual judgement, which is why this type sits entirely with the AI layer.

A natural person's name used to refer to a specific identified or identifiable individual: given names, surnames, full names, honorific-plus-name, initials with surname, compound and hyphenated surnames, non-Latin-script names, chosen and preferred names, and nicknames used as identifiers.

At each occurrence the longest contiguous name span is reported as a single detection — honorific, given names, particles and surname together — rather than several adjacent fragments.

The name of a company, institution, government body, non-profit or association where its presence is identifying, either of the organisation itself in a privacy-sensitive context or of a natural person through affiliation.

Does not cover: Brand-as-product references and generic categorical descriptions.

A professional, organisational or hierarchical role designation attached to an identifiable person. Identifying in combination with a name, an organisation or a department.

Does not cover: Department and team names on their own.

A combination of attributes, none sufficient alone, that together narrow a description to one individual or a very small group — a role plus a location plus a timeframe, for example. The full combining phrase is reported.

Attributes inside the phrase that have their own type are additionally reported as that type.

A physical mailing or location address that locates an identifiable person or organisation: street name, house number, building name, apartment, unit and floor designations, PO boxes, and the city, postal code and country components where they form part of a complete address span.

A country-specific postal code, functioning as a coarse geographic identifier when attached to a person or address.

The Rules Engine layer holds postal patterns for every supported country, but most are short digit runs that require a nearby address cue to fire, and the formats collide with other numbers. The AI layer is the authority for this type. A postal code inside a full address span is part of that ADDRESS; one appearing outside an address span is reported as POSTAL_CODE.

A geographic coordinate pair pinpointing a physical location associated with an identifiable person — home, workplace, vehicle position, or geo-located activity.

Decimal degrees are detected by rule; the AI layer adds DMS notation, plus codes, geohashes, What3Words references and coordinates described in prose.

An IPv4 address identifying a person as a network endpoint, session origin or device.

An IPv6 address (RFC 4291 / RFC 5952), in any standard notation including compressed forms. Reported separately from IPv4.

A 48-bit IEEE 802 hardware address identifying a network interface. Colon-separated, dash-separated and Cisco dot notation are all recognised. Personal data when linked to a person through device-management records, access logs, DHCP leases or captive-portal logs.

A 15-digit International Mobile Equipment Identity identifying a mobile device on a cellular network. Both the bare and separator-formatted forms are recognised. Persists across SIM changes, so it identifies the device rather than the subscriber.

An RFC 4122 / RFC 9562 universally unique identifier, with or without hyphens.

Reported only where the UUID functions as a person- or session-level identifier. UUIDs in purely technical contexts — database keys, migration scripts, build artefacts — are not personal data.

A vehicle registration plate issued by a national or sub-national authority, which identifies a vehicle and through registration records its owner.

Does not cover: The chassis identifier (VIN) or the operator's licence number (DRIVERS_LICENSE).

Plate grammars differ sharply between countries, and several — the German pattern in particular — are validated against the issuing district codes rather than shape alone, because the generic shape collides with document references and standards codes.

A 17-character ISO 3779 vehicle identification number assigned by the manufacturer, identifying the physical chassis regardless of the plate currently registered to it.

A pattern-detectable secret or authentication artifact with a recognisable prefix or shape. The engine holds dedicated patterns for AWS access key IDs and secret access keys, GitHub tokens including fine-grained PATs, GitLab tokens and PATs, Stripe secret and publishable keys, OpenAI and Anthropic API keys, Slack tokens in several forms, JWTs, SendGrid keys, HashiCorp Vault tokens, Mailgun keys, Databricks PATs, npm tokens, Google API keys, DigitalOcean tokens, Twilio account SIDs, Discord bot tokens, PEM private keys, and connection strings with embedded credentials.

Two further rules generalise beyond the named providers: an assigned-secret-value rule, and a high-entropy-token rule that fires near credential context keywords.

A credential or authentication artifact disclosed in prose rather than as a recognisable token: passwords, spelled-out keys, connection strings described in sentences, recovery codes, security questions and answers, and system PINs.

This is the unstructured counterpart to SECRET. Where SECRET is a shape the engine can match, CREDENTIAL is a sentence the model has to understand.

An explicit calendar date stating when an identifiable person was born — typically the highest-value quasi-identifier in tabular data. Detected in DD/MM/YYYY and ISO YYYY-MM-DD forms, but only with a positive context cue: a date alone is never assumed to be a birth date.

The AI layer covers birth dates stated in prose and in regional formats outside those two. Where a birth date is embedded in a national identifier, the identifier is reported whole and the embedded date is not separately reported.

An explicit calendar date stating when an identifiable person died, detected on the same mechanics as DOB and likewise requiring a positive cue — overlijdensdatum, Sterbedatum, date de décès and equivalents.

Does not cover: Funeral, memorial or probate dates.

Sensitive both under member-state post-mortem privacy provisions and for living next-of-kin contexts such as insurance claims and estate administration.

A company or business registration number issued by a commerce registry, trade register or statistics authority — the Dutch KvK number, German HRB, Belgian BCE/KBO, Danish CVR, Finnish business ID and Norwegian organisasjonsnummer among them. Several are checksum-validated.

Does not cover: VAT registration (VAT) or personal taxpayer identification (TAX_ID).

An organisation-assigned identifier that identifies a specific person, account, customer, employee, case or record within that organisation's domain, and that fits no more specific type. Covers employee numbers, badge and keycard numbers, customer and account references, and claim, policy and report references tied to a claimant.

Does not cover: Purchase-order numbers, cost-centre codes and ticket numbers that are not tied to a person. These are not personal data and are not reported.

This is the residual type — used only when nothing more specific applies.