> ## Documentation Index
> Fetch the complete documentation index at: https://docs.useboom.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Hide sensitive customer data

> Choose which customer fields your AI agents and teammates without access can't read, from Settings › Sensitive data.

Some customer data shouldn't reach an AI agent or every person on your team: a
tax ID, the last digits of a card, a home address. In Boom you mark those
fields **Hidden**. The value stays stored and keeps working, but agents read
`[redacted]` in its place and teammates without access see a **Hidden** lock.

Nothing is hidden until you hide it.

<Note>
  Sensitive data is turned on per workspace. Ask Boom to enable it for yours.
  Until then, the settings page doesn't appear and the API answers
  `sensitive_data_unavailable` when you try to hide a field.
</Note>

<Tip>
  Looking for how to keep parts of **your own app** out of what the web
  widget's in-app expert reads? That's a different feature:
  [Protecting sensitive data](/protecting-sensitive-data).
</Tip>

## Hide a field

1. Go to **Settings › Sensitive data**.
2. Find the field. The page has three sections:
   * **Built-in fields**: email, phone number, first name and last name, the
     contact fields every person has.
   * **People attributes**: extra fields from your integrations and imports.
     Search by key, or filter by **Hidden** or **Looks personal**.
   * **Custom objects**: fields on records like orders, policies or accounts.
3. Turn on its switch. The field is hidden right away; there's nothing to save.

To show a field again, turn its switch off. Boom asks you to confirm, because
agents and teammates without access can read it again from their next message.

**External ID can't be hidden.** Boom uses it to match people across your
systems.

### Hide the copies too

Hiding a built-in field doesn't hide an attribute that holds the same data,
such as an `email` attribute next to the built-in email. When you hide a
built-in, Boom lists attributes that look like copies of it. Choose **Hide
these too** to hide them in one step, or **Not now** to leave them visible.

New attributes from a sync start visible, and a sync never changes what you've
hidden.

### Who can change it

Only **Owners** and **Admins** can hide or show fields. Other roles that can
open settings see the page read-only.

## What your agents see

Every AI agent in Boom (the agent in your conversations, voice calls, the
in-app assistant, and AI tools connected over MCP) gets `[redacted]` in place
of a hidden value. The agent knows the field exists, so it never asks the
customer to repeat it and never tries to guess it. If it needs the value, it
escalates to your team.

One exception: in a conversation, the agent still knows the name of the person
it's talking to, so it can greet them. Hiding names hides them everywhere else,
including when an agent looks up or reads about other customers.

An agent also can't work out a hidden value indirectly. If it tries to filter,
group or list the distinct values of a hidden field, Boom refuses.

First and last name are hidden separately. Hide only the last name and agents
see `Ana [redacted]`. A stored full name Boom can't split safely, such as a
WhatsApp profile name, is hidden whole.

## What your teammates see

| Role | What they see |
| - | - |
| Owner, Admin, Developer | The value |
| Everyone else | A **Hidden** lock instead of the value |

You can see the full list on **Settings › Organization › Roles**, in the
**Sensitive data (hidden fields)** row.

With only the last name hidden, teammates without access see "Ana" with a
**Hidden** lock next to it.

## What keeps working

Hiding a field changes who can **read** it, not how Boom uses it.

* **Segments** you build in the dashboard can still filter on hidden fields.
* **Journeys** can still send a hidden field in a message. The builder warns
  you, because sending it puts the value somewhere new:

  * `SENSITIVE_FIELD_SENT`: a message (WhatsApp, SMS, email, Instagram,
    Messenger) puts the value in the conversation, where the agent and inbox
    users can read it.
  * `SENSITIVE_FIELD_SENT_EXTERNAL`: an HTTP request sends it to an external
    URL.
  * `SENSITIVE_FIELD_MAPPED`: a route-to-initiative step copies it into
    another initiative's context.

  These are warnings only. They never block publishing.

## Exports

* A **segment CSV export** by someone who can't see hidden values is refused
  with `hidden_fields` while any built-in field is hidden.
* **Initiative participant exports** write `[redacted]` in place of a hidden
  name or phone for people without access.

## Hide fields with the API or MCP

You can also hide fields with the REST API (`GET` and `POST
/api/v1/cdp/sensitive-fields`) or from an AI tool connected over
[MCP](/use-mcp). An AI tool can only **hide** a field, never show one again.
See [Sensitive fields](/cdp/sensitive-fields) for the request format and the
full reference.

## Not covered yet

A few screens still show the real value to teammates who can open them:

* An initiative's **Contacts** tab.
* The view of a single run (one participant's timeline and enrollment
  requests).
* Computed segment columns whose formula reads a hidden field.

For what an agent can still see, such as the values typed into an existing
segment filter, see [Known limitations](/cdp/sensitive-fields#known-limitations).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.