Card numbers are hidden from every conversation, and your own patterns can hide, refuse or flag anything else you would rather not keep or send.
When a customer types a payment card number into a conversation, only its last four digits are kept, as in •••• 4242. The full number is never saved, shown to your team, or passed to your bot or any of its steps. Replies from your team and your bot are treated the same way, and so are internal notes, tickets, close notes, descriptions of the files customers send, and comments and mentions on the social accounts you listen to.
This is on for every workspace, on every plan, in UniversalChatbot and UniversalDesk, and cannot be turned off. A number counts as a card number when it has the length and leading digits of a card network (Visa, Mastercard, American Express, Discover, JCB, Diners Club, UnionPay, Verve, Maestro, Mir or RuPay) and passes the check digit cards carry, so phone numbers and most order numbers are left alone. It is found however it is written: in groups split by spaces, dots, dashes, slashes or commas, and in full-width or other digits.
What was hidden cannot be brought back. Ask customers to pay through a payment link rather than in the chat.
On the UniversalChatbot Business plan you can add patterns of your own. Pick a ready-made one or write a regular expression:
Each pattern checks messages from customers, replies to customers, or both.
Each pattern decides what happens to the text it matches:
Separately, a pattern can flag the message. A flagged message is marked in the inbox with the pattern's name. A pattern can mask and flag at once. Refused replies are always recorded, so they need no flag.
Card numbers are masked, and patterns apply, from the moment they are in place onward. Messages already in a conversation are not changed.
The messaging platform a customer writes on, such as WhatsApp, Intercom, Messenger, Instagram, Telegram or X, keeps its own copy of what the customer sent, under its own terms.
Your bot and every one of its steps only ever see the masked text, on every channel: the last four digits of a card number, and the pattern's name in brackets for anything your own patterns mask. That includes its variables and AI steps, and also the steps that look something up, such as a table lookup, list or delete, a call to one of your endpoints, and a condition. A flow that needs to find something by what a pattern masks will not find it, so mask only what your bot never needs to look up.
A reply that is refused leaves no question waiting: the next time the bot answers, it starts the flow from the beginning. When the team the conversation goes to is closed and leaves its conversations to the bot after hours, the customer is told the team's after-hours message instead, and the bot keeps answering.
The text of every message on every channel, the caption on a photo or file, what the bot writes down about a file a customer sends (the words of a voice note, the text in an image), and the values an agent fills into a WhatsApp template. Your team's internal notes, ticket titles and updates, close notes and reasons for declining a conversation are checked by card numbers and by every pattern that masks, whichever messages it checks. The files themselves are not changed.
A pattern that takes too long to check a message stops checking it, so a slow pattern never holds a conversation up. In a message from a customer or a note, that pattern is skipped for that text, while card numbers and your other patterns still apply. A reply it cannot decide on is handled as if the pattern matched: a pattern that masks replaces the whole reply with its name, a reply it would refuse is not sent, and a pattern that flags flags the reply. A pattern that is too slow on five messages in a day is switched off, and the people who get your workspace's connection alerts are emailed so someone can fix it. Keep patterns simple so this does not happen.
A pattern that would match empty text, a single space or a line break is refused when you save it, since it would match nearly every message.
In UniversalChatbot, the owner and managers open Settings → Security → Sensitive data. Add a pattern, choose which messages it checks, what happens when it matches and whether to flag it. Add a few sample texts to see what it matches before customers do. Switch a pattern off to stop it without deleting it. A workspace can have up to 25 patterns.
In UniversalChatbot, changes to patterns are recorded in the audit log.
Every message with something masked or flagged, and every reply refused, is recorded with the patterns' names, never the text they matched. Card numbers are recorded as masked too.
In UniversalChatbot, these records are in the audit log: choose Sensitive data there to see only them.
The report, under Settings → Security → Sensitive data report, adds them up over the last 7, 30 or 90 days: how much was masked, flagged and refused compared with the period before, which patterns matched most, what each agent's own replies matched, and the latest cases with a link to each conversation. It is for the same people who set the patterns.