Masking User Emails/Contact Info

Product Support

AI-generated summary

The discussion revolves around whether Discourse has built-in capabilities to mask or protect personally identifiable information (PII) like email addresses and phone numbers when users share them publicly. Justin_Gonzalez asks if there’s a setting to prevent users from posting PII. Canapin suggests using regex in watched words, though it may not be reliable. sam references an AI moderator’s recommendation, explaining that while Discourse can detect PII, it requires configuring an LLM and a battle-tested persona for detection. The preferred approach is to flag such content rather than edit it, as editing users’ posts can cause frustration. Alternatively, basic protection can be achieved by banning email entries via watched words and regex, though this method is unreliable. The image shows a chat where an AI moderator advises checking built-in features for PII protection.

1

Does Discourse have the ability to mask a user’s contact information when they make it public? In other words, if a user shares their email address or phone number in a public topic, what are the best practices to ensure we 1. Resolve the customer’s question and 2. Protect their information.

3

I suppose you could use corresponding regexes in watched words, but phone numbers might be more difficult to detect.
It will trigger watched words even if the email adress or phone number isn’t theirs.

4

There’s not just a setting I’m missing that protects or prevents users from posting PII?

6

Its funny, this was triaged by our experimental AI moderator:

The image is a screenshot of a chat showing a user asking about privacy protection settings and a bot's recommendation to check for built-in features to prevent users from posting personally identifiable information. (Captioned by AI)
The image is a screenshot of a chat showing a user asking about privacy protection settings and a bot's recommendation to check for built-in features to prevent users from posting personally identifiable information. (Captioned by AI)507×311 32.8 KB

So here I am responding as instructed by the robot :stuck_out_tongue:

The answer is yes, this is built in provided you configure everything just right.

  1. You need an LLM that can confidently do the detection’
  2. You need to battle test a persona for detection
  3. Once you have a battle tested persona you can either use it to triage and flag

Regarding “edit out PII” , this is somewhat risky, cause once you start mucking with peoples words they tend to get upset. My recommendation would be to start with flagging.

Alternatively for some very rudimentary setting you could “ban” entering emails at all using watched words and a regex, but that is somewhat messy and will not be super reliable.