PII detection

Spot fields that likely hold personal data — from metadata alone.

Detected from metadata, never from records

PII detection flags fields that likely hold personal data using only the field's name, label, and data type — never record values. This is exactly why SchemaForce can claim it never reads your data: the signal comes entirely from the schema.

SchemaForce flags fields as possible PII so you can find personal data across your org without ever opening a record. Because the signal is metadata, the flag is a strong hint to review — not a guarantee — but it's enough to catch the fields that deserve a closer look.

Categories

A flagged field is tagged with a category. Categories are evaluated in sensitivity order, and the first match wins:

#Category
1Government ID
2Financial
3Health
4Credentials
5Date of birth
6Person name
7Email
8Phone
9Address
10Demographic
11IP / device

Some categories also key off the data type — for example, email and phone. Matching is whole-token, so it avoids false positives like filename matching on "name".

Where it shows up

Field Governance badge

A "Possible PII · <category>" badge on the field detail page. Its tooltip reads: "Detected from this field's name, label, and type — never from record values."

Needs Attention

A Looks like PII bucket in the Needs Attention cleanup view.

Least-privilege flag

Powers the permissions flag for PII-looking fields a grantor can edit.

Plan

PII detection is not plan-gated — it's on for every connected org.

Was this page helpful?