LAWDE Shield · Documentation

Custom PII scrubbing

Custom scrubbers are rules you add in the dashboard — not a config file in your repo. Workspace baseline rules run on every app after built-in masking; per-app additional rules stack on top. No redeploy.

Where it lives

Open Settings → Custom scrubbers. This is a GUI on Business and Enterprise. There is no .lawdescrub file and no SDK option that replaces these rules.

FactBehavior
ScopeWorkspace baseline (all apps) plus optional per-app additional rules. New apps inherit baseline automatically.
When they runAfter built-in masking, on future ingests
DeployNone. Save a rule in the UI; the next crash uses it
ValidationInvalid patterns are rejected before save. Preview before you enable.

Built-in masking vs custom rules

Built-in masking always runs on Hobby through Enterprise. It already covers common secrets and personal data.

Custom rules are for your identifiers — patient IDs, staff codes, local phone formats — that a generic pass cannot guess. Use the live preview in Settings; do not copy a public pattern catalog.

Example identifier shapes

In the GUI, describe the IDs you actually log. Typical shapes teams add: patient numbers like PAT-123456, staff codes like EMP-1234, or a local phone format. Replacement tokens look like [MASKED_PATIENT_ID].

Live preview walkthrough

  1. Open Custom scrubbers and click Add rule.
  2. Give the rule a short name (for example “Patient ID”).
  3. Enter a pattern that matches your ID format. Invalid patterns are rejected before save.
  4. Set the replacement token, such as [MASKED_PATIENT_ID].
  5. Use the sample box to confirm the preview. A typical sample:
text
Patient PAT-123456 checked in with card 4111-1111-1111-1111
Staff EMP-1234 called 08012345678 about user@acme.com

Enable the rule. New errors from Node, Python, HTTP, or any other reporter on this workspace pick it up. Already-stored events are not rewritten.