Core functionality recipes

Tips and tricks

Getting in touch

How do I make sure sensitive data doesn't leave my Jira / Confluence?

PII Protector never communicates or transfers data outside of your Jira or Confluence instance. All the logic is available inside the installed add-on, and the used storage is inside the Jira instance as well. There is no need to communicate outside, and the add-on works without extranet access. Your data never leaves your servers.

How do I mask or erase sensitive data automatically as soon as it enters Jira / Confluence?

Dealing with every new introduced PII item may be tedious, especially if you have many Jira or Confluence users. PII Protector tries to help here with the unique concept of automatic actions. In a nutshell, you are able to configure what to do with the new PII the moment it is discovered. The default is mere reporting, but you can also erase it completely or mask/hide and audit access to it. Of course, every action is reversible from the management UI. To configure automatic actions, go to PII detection rules, edit them, click Configure detection threshold and automatic actions... link to go into advanced configuration mode and set the automatic action for each PII type individually.

How do I browse all detected sensitive information?

All detected sensitive data is conveniently displayed and can be reviewed or manually curated in PII Manager UI. It provides a single place where PII administrators can browse, manage, mask, delete, restore PII, or mark is as ignored. It's possible to act on discovered PII individually or work with many instances in batches. Access to PII Manager is restricted and can be configured according to your organization policies and needs.

How do I mask specific detected PII manually?

PII administrators can act on all detected PII occurrences via PII Manager UI. This page can be accessed from Administration / System menu and allows a wide range of operations on detected sensitive information. To mask a specific PII occurrence, locate it in the table, click the gear button of the corresponding row and select Hide and Audit option. This will immediately mask the specific occurrence of this PII in the Jira / Confluence interface, so it can't be seen immediately when viewing content. The users will still be able to click the mask and see the PII, but only if they have permission to access PII. Additionally, every access to the hidden / masked PII is tracked and can be seen in the PII Protector Access Log providing full audit trail for accessing sensitive data.

How do I undo previous changes to PII, e.g. masking or deletion?

All actions in PII Protector are reversible. To restore the data manually, go to PII Manager, find the PII you want to restore, and restore it by clicking the gear button in the corresponding row and selecting Restore operation from the menu. Please note that while hidden / masked PII can be restored at any time, the erased PII have configurable retention period after which the data is wiped out completely and thus can't be restored anymore.

How do I perform bulk operation on multiple detected PII?

It's possible to update PII in bulk either manually or automatically. In manual mode, going to PII Manager, selecting multiple records via checkboxes, and then performing any operation from the dropdown menu after clicking a gear button on any of the records will perform the chosen action on all of the selected PII. In automatic mode, once you configure an automatic action in add-on settings, it will get applied to all PII, both already detected and those that will be found in future.

How do I make sure the detected information is up-to-date?

PII Protector is on top of any changes to your information, so it keeps PII data up-to-date automatically. There is nothing else you need to do.

How do I detect national identification numbers for my country?

PII Protector supports the following national identification numbers natively (with appropriate checks for checksum/validity):

  • United States - Social Security Number (SSN)
  • Canada - Social Insurance Number (SIN)
  • United Kingdom - National Insurance Number (NINO)
  • France - Social Insurance Number (INSEE)
  • Switzerland - Social Security Number (SSN)
  • Sweden - Personal Identity Number
  • Norway - Birth Number
  • Finland - Personal Identity Code (HETU)
  • Denmark - Personal Identification Number (CPR)
  • Czech Republic - Birth Number
  • Poland - Public Electronic Census System Number (PESEL)
  • Spain - National Identity Document Number (DNI)

If your country is not listed, please let us know so we can add it, and in the meantime set up a custom PII type to at least structurally detect the identification numbers. This can lead to false positives, but can get you something to work with immediately.

How do I add custom fields that the tool will scan for PII?

PII Protector for Jira only scans issue summary, description, comments and history. If you want to scan additional custom fields that contain free-form text data, you can add them in PII detection rules by specifying them in Custom fields field.

How do I configure detection threshold and what do low, medium and high thresholds mean?

PII detection for built-in types is never exact and can have false positives and negatives. There is always a chance that something that looks like a credit card number is in fact just a benign numeric sequence. To improve precision, we look at the surrounding context for the found potential PII and apply some heuristics to decide how confident we are that the detected instance is really PII. The detection threshold parameter in PII type configuration controls the trade-off between the precision and recall of the detection. The higher the detection threshold, the higher our confidence is in that what we detect as PII is in fact PII. So, with the higher threshold we increase precision but may decrease recall. What happens exactly depends on the PII type and context, so it's not easy to summarize. The exact behavior will also likely change as we refine the algorithms. But it's a lever for users to configure on a per-PII-type basis how they are willing to trade off false positives and false negatives.

How do I configure who can see PII?

There are two places where users can see PII once it's detected. One is PII management UI (PII Manager). The other is a separate page that is linked directly from the issue/page and requires a click to be shown. This latter place is only relevant for hidden (masked) PII.

Access to PII Manager is configurable. It's jira-administrators or confluence-administrators by default, but you can set a different group in add-on configuration (PII admin groups setting). You can also have per-project access for project admins (Project PII tools setting).

Access to hidden (masked) PII from the content (not PII manager) is either everybody who has access to the content (but they would still need to explicitly access PII by clicking the corresponding link) or the same set as in the previous item (Hidden PII access setting).

How do I configure how long to keep logs?

There are two logs in PII Protector.

  1. Access log stores information about which users accessed which PII.
  2. Action log stores information which actions were applied to which PII.
Retention period for both action and access log is configurable in add-on configuration. Use Keep logs for parameter to specify the desired number of days. Note that this is different from the Retention period setting which controls how long to keep information about erased PII around.

How do I configure different rules for different projects, spaces or issue statuses?

This is now available! Please go to PII Detection Rules and add/modify different rules specifying appropriate scope using JQL/CQL restriction. When you first install the app, there will be a single pre-configured rule without any restrictions, which means it will scan all content in Jira / Confluence.

How do I make sure PII is not included in email notifications?

This works out of the box now! All you need to do is enabling either hide and audit or delete automatc action, and the newly added PII will be masked or removed from the content before the corresponding notification is sent by Jira / Confluence.

How do I start from scratch?

If you got yourself into a bad state configuring PII Protector or have too many detected items you don't want, you can revert the app to the state right after installation. You can go to Add-on config and click the Reset PII Protector button in the top-right corner, then click Reset to confirm (and potentially restore some data prior to proceeding). Note that this will erase all your current PII configuration, so keep it on the side if it's needed and restore later. This will also trigger a full scan with default parameters, just like the one that happened upon the initial installation. Use this carefully.

How do I ignore internal IP addresses and email addresses when detecting sensitive data?

We understand that not all occurrences of some PII type are equally important, and sometimes you want to treat them differently depending on the specific content. A prominent example is hiding email addresses but only for external partners or customers while keeping internal emails intact. This can be configured in PII Protector by adding a whitelist pattern regular expression to the corresponding PII type configuration. E.g. to whitelist and ignore all email addresses at test.com domain, you could specify .*@test\.com value in whitelist pattern field. The same technique can be used to whitelist internal IP addresses.

How do I mask PII in a particular way, e.g. mask everything except the 6 first and 4 last digits of the credit card number according to PCI DSS?

Payment Card Industry Data Security Standard requires to mask everything in credit card number except the 6 first and 4 last digits. PII Protector supports this by allowing a replacement mode in which a configurable number of characters at the beginning and at the end of the PII text is kept intact and everything else is masked.

How do I tune configuration if some PII cannot be found?

Detecting PII precisely and without misses is hard. Sometimes things look like PII but are in fact not. In other cases, PII is there but is in a very unconventional format and hard to detect. PII Protector uses heuristics to assist with detection and allows fine tuning to achieve the right trade-off between precision and recall. The tuning is available for each built-in PII type individually by means of the detection threshold parameter in PII type configuration. If some PII cannot be found, try lowering the detection threshold for the PII type.

How do I tune configuration if some data is incorrectly identified as PII?

Detecting PII precisely and without misses is hard. Sometimes things look like PII but are in fact not. In other cases, PII is there but is in a very unconventional format and hard to detect. PII Protector uses heuristics to assist with detection and allows fine tuning to achieve the right trade-off between precision and recall. The tuning is available for each built-in PII type individually by means of the detection threshold parameter in PII type configuration. If some PII cannot be found, try raising the detection threshold for the PII type.

How do I detect PII type not supported natively by PII Protector?

We do our best to support all types of sensitive information, but we understand there will be things we don't yet support. There are two solutions to that.

  1. Short-term, you can create and configure your own custom PII type based on a regular expression. You will be able to configure it by clicking Custom PII link in PII Manager or corresponding menu item. All the flexible settings that we provide for built-in PII types are also available for custom types. They are first-class citizens in PII Protector and a very powerful feature.
  2. Long-term, we will definitely want to hear from you and will be willing to add your PII type as a built-in one in future versions of PII Protector. This will shift the responsibility for the maintenance of the configuration from you to us and will simplify things for you. Please drop us a line at support@enhancera.com or use the contact form on our site to reach out to us and tell us about your requirements. We love to hear from users.

How do I mask social security numbers (or other PII) in a custom field only?

PII Protector can be configured to mask sensitive information in custom fields. It's also possible to disable scanning for other fields. Several things need to be configured in add-on settings for this:

  1. You'll need to enable automatic actions for SSN PII type and set it to Hide and audit.
  2. You'll also need to specify your custom field to the custom fields list for scanning and remove standard fields you don't want to scan.

With that configuration, PII will get masked in issues in the specified custom field, but not anywhere else.

How do I configure PII Protector to wipe out erased or masked PII?

The retention period for erased PII (the items in "erased" state) is configurable in add-on option (Retention period setting). Once retention period is over, the PII will be marked as obsolete. It will still be kept around as long as the access and audit logs for it are available, which is configurable via add-on option (Keep logs for setting). Once the logs are no longer kept, the PII data is wiped out from the system completely, and it will be impossible to see or restore it.

On the other hand, the masked PII (the items in "hidden" state) will never be wiped out from the system, so there will always be an option to restore.

How do I test credit card numbers detection? Will fake card numbers like 4111-1111-1111-1111 work?

There are some known ranges for card numbers from different issuers and valid numbers also need to pass Luhn checksum validation (see here: https://www.freeformatter.com/credit-card-number-generator-validator.html). We use this knowledge to ignore non-real card numbers. So, test card numbers like 4111-1111-1111-1111 will not be detected. Use fake numbers from the page referenced above instead.

How do I never show ignored PII in reports?

Sometimes PII are correctly found by PII Protector, but for one reason or another the admins are comfortable with them to stay in the system and would want to ignore them. They can apply Ignore action to these occurrences. However, the ignored PII will still show up in PII Protector. If you don't want to see them there, you can set up the filter to only include the rest of the statuses. You can also bookmark a link to the page with that filter applied, which will look like http://jirahost/plugins/servlet/pii4jira/manage?statuses=NEW&statuses=ERASED&statuses=HIDDEN&statuses=EDITED&statuses=RESTORED

How do I make sure the PII is detected immediately?

You need to do nothing. PII Protector is designed to analyze the content of new or changed data like issues, pages or comments immediately when a change happens. If an occurrence of sensitive data is detected, the automatic actions will run immediately, and the PII will show up in PII Manager right away. Note, however, that if you change PII detection configuration, the changes will not be noticed until the next scheduled or manually invoked full scan. If you change the configuration and want to get it applied immediately, please launch a manual scan.

How do I trigger a new scan for PII immediately?

PII Protector detects sensitive information on the fly, but sometimes you want to trigger a full rescan (e.g. if you made a significant and urgent change in detector configuration). This is possible. Go to PII Manager, click Scan status button in the upper-right corner, then click Scan now. If another scan is currently running, you'll first need to click Stop in order to interrupt it and then click Scan now.

How do I allow access to view PII to select trusted users and not anybody else?

PII Protector can be configured to allow access to PII only to some users and not others. There are several configuration settings that need to be modified for this.

  1. You'll need to enable automatic actions for all PII types you are interested in and set them to Hide and audit.
  2. Additionally, you will need to restrict access to hidden (masked) PII by specifying the group of trusted PII viewers in PII admin groups setting and also setting Hidden PII access setting to PII admins in add-on configuration.

With that configuration, PII will get masked in issues, but clicking on the mask will display the PII (and audit access to it) for trusted viewers only. Everybody else will get their access denied.

How do I remove occurrences of a particular name, email or some other personal data from your Jira / Confluence instance content?

This is not a primary use case for PII Protector, but it's something the tool can do for you reasonably well. You can utilize the custom PII type feature for this and create a custom PII type with the regular expression that matches the content you'd like to remove, e.g. a name. Note that you'll need to be as specific as possible when specifying the regular expression to minimize the number of false positives. After the new type is set up and enabled, a scan will run on schedule (or you can trigger it on demand), and you will be able to see the matches in PII Manager. Note that you can specify only the new custom PII type in the filter in the UI. You can then review the detected occurrences and apply the erase action to the ones you feel justify this (remember you can select multiple/all records and do a bulk operation). Finally, the last step is to go back to the custom PII configuration and remove the PII type (if it was a one-off) to prevent restoring data and also keep the configuration clean and tidy.

How do I perform global find and replace operation for text in Jira / Confluence?

This is not a primary use case for PII Protector, but it's something the tool can do for you reasonably well. You can utilize the custom PII type feature for this and create a custom PII type with the regular expression that matches the content you'd like to replace, e.g. a name. Note that you'll need to be as specific as possible when specifying the regular expression to minimize the number of false positives. After the new type is set up and enabled, a scan will run on schedule (or you can trigger it on demand), and you will be able to see the matches in PII Manager. Note that you can specify only the new custom PII type in the filter in the UI. You can then review the detected occurrences and apply the edit action to the ones you feel justify this (remember you can select multiple/all records and do a bulk operation). Finally, the last step is to go back to the custom PII configuration and remove the PII type (if it was a one-off) to prevent restoring data and also keep the configuration clean and tidy.

How do I decide on the frequency of periodic scans?

When enabled, PII Protector actively monitors any updates to Jira / Confluence content and detects PII the moment it enters the system. Still, periodic scans are needed for things like detecting sensitive information right after the app is installed or detecting sensitive data after app configuraton updates. Periodic scans consume host application resources, so judgement needs to be use when making decision on how frequently they should run.

There is no one size fits all solution for this, but we believe that most users will be OK with a scan schedule that performs full scans approximately every week. We also recommend to trigger a manual scan after a major change to PII Protector configuration is made to ensure that the updates come into effect ASAP in such cases.

How do I request a new feature to be added?

Please send us an email at support@enhancera.com or use the contact form. We take client support very seriously, answer quickly, and are extremely happy to get in touch with our users and understand their needs better. Customer feedback is the primary factor in prioritizing our backlog.

How do I get quick help if something is not working as expected or there are any questions?

Please send us an email at support@enhancera.com or use the contact form. We take client support very seriously, know this stuff, answer quickly, act on feedback, and are extremely happy to get in touch with our users.