> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/capabilities/code-reviews/secrets-detection/confidential-data-detection.md).

# Confidential Data Detection

When enabled, Nullify inspects diffs for sensitive personal information that should not live in source control. Findings appear in the dashboard with the relevant PII category and remediation guidance. Remove the exposed data and assess downstream copies and access; credential rotation is not a remedy for personal-data exposure.

## Categories We Classify

* Personal information: email addresses, phone numbers, postal addresses, dates of birth, and US Social Security Numbers.
* Financial information: payment card numbers.
* Location and identity data sourced from structured dumps or seed files.

All detections currently focus on English-language datasets.

## Example Workflow

1. A developer commits a seed file containing realistic user records (`create.sql`).
2. Nullify analyses the diff, labels the exposure as **Personal Information**, and posts the finding to the dashboard.
3. The reviewer can remediate, suppress with justification, or convert the event into a campaign task.

![Sample SQL seed file](https://3946391995-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FId2OtLCL6O6V3XSRYxtr%2Fuploads%2Fgit-blob-9ea5344b34878a13da262e0236651bf6688e3fc0%2Fpii-sql-example.png?alt=media) Review detected data in the current **Findings** view, scoped to the sensitive-data category. The SQL image is an illustrative input, not a screenshot of the current dashboard.

> 💡 PII detection is available to enterprise tenants on request. Contact your Nullify representative to enable it for your environment.