Plan requirement
| Subscription | Suite Growth or higher, Support Professional or higher |
| Access | Admin |
Card numbers redacted on arrival, without anybody noticing them first. Three things to know before you rely on it: it leaves the first six and last four digits intact, it does nothing to numbers already in your account, and it cannot be combined with redaction suggestions.
Turn it on
- In Admin Center, click Account in the sidebar.
- Select Security, then More settings.
- On the Zendesk Support tab, in the Redaction section, select Redact credit card numbers.
- Save, then send a test ticket with a sample number and confirm the result.
It acts when the ticket is created and on future comments and internal notes, covering ticket comments and custom fields.
What is left behind
The middle digits are replaced with a character, and the first six and last four remain, so a redacted number reads like 12345 ▇▇▇▇ ▇2348. The original is removed from logs and database entries and held in memory only long enough to check it.
That is the right design for the risk, and it is not the same as the number being gone. If your obligation is that no part of a card number is stored, this setting alone does not meet it.
What it does not catch
| Numbers already in your account | Only new content is processed. Switching this on does not clean up history. |
| Attachments | A number in a photograph is a picture, and stays. |
| Numbers outside 12 to 19 digits | Only that range is processed. |
| MIME-encoded emails and custom fields in suspended tickets | Currently retain the original. |
Detection uses the Luhn algorithm along with card prefix and length checks, and Zendesk does not guarantee that every card number is identified. Treat it as a strong net rather than a complete one.
Do not run this alongside redaction suggestions. The two features are incompatible, and Zendesk advises against using trigger-based redaction together with automatic credit card redaction. Choose one approach for card numbers rather than layering both.
Still ask people not to send them
A line on the request form saying never to send full card details prevents more than the automatic rule catches, and it costs one sentence. It also covers the photograph, which nothing else does.
Tell agents what happens
They will see partly redacted content and wonder whether they broke something. Explaining it once prevents that, and it teaches them to redact the cases the rule misses.
Comments
0 comments
Article is closed for comments.