Configure sensitive-data masking rules

Updated Monday, October 26, 2026 · Marc Staine

Data masking replaces matching text in supported rendered content. It can reduce accidental exposure of recognizable identifiers while preserving the underlying record for authorized operational needs.

Applies to: Supportbench Core. Location: Settings → Cases → Data Masking. Access and available controls depend on your role and account capabilities.

Before you begin

You need permission to edit this configuration. Ask an administrator if the page is available but its editing controls are not.
Review the current configuration and where it is used before making a change. Available choices depend on your account, enabled modules, division access and role.
Use a test record or a controlled test account for behavior checks. Do not change production routing or send customer messages just to try an example.

Configure and verify

Open Settings → Cases → Data Masking.
Find the item in the list and open it, or choose the page’s new-item action.
Enter a clear name and description. Set the fields below, including any scope, hierarchy, visibility or availability controls.
Save the item and resolve any validation message. Reopen it to confirm the saved values.
Check the relevant selection list or form using a user with the intended access. Repeat for an excluded user or division when scope is restricted.

Settings reference

Rule

Setting	What it controls	How to choose
Name	Rule name up to 200 characters.	Describe the data pattern and purpose.
Type	Industry default, regular expression or exact text.	Prefer a built-in pattern when it accurately matches your use case.
Industry pattern	Supported presets include Phone, SIN, SSN, Credit card and Email.	Test realistic synthetic examples and false positives.
Pattern / Replacement	Custom match and replacement values, each up to 200 characters.	Use a clear neutral replacement without repeating sensitive data.
Attachment metadata / Active	Applies the supported metadata masking and enables the rule.	Check filenames separately from attachment contents.

Scope and test

Setting	What it controls	How to choose
Public / Internal	At least one content audience must be selected.	Choose the surfaces that should receive masking.
Divisions / Roles	Optional scope; empty selections mean all applicable divisions or roles.	Check an included and excluded viewer.
Test text / Filename / Path	Synthetic inputs for a rule test; does not save the rule or log the samples.	Use fictional examples, not real secrets or personal identifiers.
Audit	Shows rule maintenance details.	Review when the rule was last changed.

AI Regex Assist

Setting	What it controls	How to choose
Sensitive data to detect	Describes the intended pattern to the drafting assistant.	Describe the structure without including real sensitive values.
Matching / Non-matching examples	Examples that should and should not be masked.	Use fictional values to expose likely false positives.
Draft Regex / Use Draft	Generates a candidate pattern and applies the selected draft to the rule editor.	Review the pattern, test it in preview and save only after matching and nonmatching cases behave correctly.

Behavior to know

Masking is a display transformation, not deletion or irreversible redaction of the stored source.
New rules start with Phone, Active, public and internal scope, and attachment metadata off.
Regular expressions use case-insensitive and multiline matching with a two-second timeout. Keep patterns bounded and test them.

Recommended use

Use terminology that agents and customers already understand. Explain the intended meaning in the description.
Keep the initial configuration small enough for people to choose consistently. Add options when they represent a real operational difference.
Review existing references before renaming, changing scope, or deleting. Where supported, deactivate an obsolete option before considering permanent deletion.

Worked example

Create a rule using a supported preset and a clear replacement.
Choose public/internal scope and any division or role limits.
Test synthetic matching text and similar nonmatching text.
Save and inspect a controlled rendered record under each relevant audience.

Troubleshooting

Problem	What to check
The item is missing from a picker.	Check Active, division access, parent hierarchy, enabled modules, and the user’s role. Reopen the consuming form after saving.
The form rejects a save.	Read the displayed validation message. Check required values, text limits and permitted scope; do not change unrelated settings to bypass validation.
An existing record still shows an old value.	A configuration change and a record change are different operations. Inspect the record and relevant references before assuming the save failed.

Organization → Configure agent roles and division access
Organization → Configure divisions

Was this article helpful?