product / detection
Detection
Everything downstream depends on this stage. A sanitizer that misses a span is worse than no sanitizer, because it produces confidence you have not earned.
The problem
Sensitive data does not arrive labelled. It arrives inside a free-text ticket, a PDF attachment, a stack trace, a column someone named notes, or a JSON blob a vendor changed last week. Regex alone over-matches on some classes and misses others entirely, and a model alone is non-deterministic in a place where you need to explain yourself to an auditor.
How Divelai handles it
Four layers run in one pass, and every hit records which layer produced it so you can tune the ones that misfire.
Patterns with validation
Structured identifiers — card numbers, IBANs, national IDs, API keys — matched by pattern and then confirmed by checksum. A 16-digit order number that fails Luhn is not a card number, and Divelai will not redact it.
Context-aware classification
Names, addresses, health conditions, and free-text identifiers are classified with a model that reads surrounding context. April in a date field is a month; in a signature block it is a person.
Your own schema
Point Divelai at the columns, keys, and headers that carry sensitive data in your systems. Declared fields are treated as sensitive regardless of what the content looks like.
Structural extraction
Documents, spreadsheets, and log lines are parsed before classification so a value inside a PDF table is seen as a field, not as a run of characters.
# Explicit. Nothing runs that you did not enable. detect: - pii.email # pattern - pii.person # ml, context-aware - pii.phone - phi.mrn - pci.pan # pattern + luhn - secret.api_key - custom.account_ref: match: "ACC-[0-9]{8}" fields: ["account", "ref", "notes"] on_low_confidence: quarantine # never silently pass
Limits worth stating
Free-text classification is probabilistic. Divelai reports a confidence score per span and lets you decide the failure mode — block, quarantine, or pass with a flag — but it cannot promise a 100% recall rate on unstructured prose, and no honest vendor will.
Detection runs on what it can parse. Encrypted attachments, images without OCR enabled, and proprietary binary formats pass through unexamined unless you configure otherwise. Measured recall by data class [CONFIRM]