Packages / Finance And Payments
Banking, payment, tax, invoice, accounting, fraud, and financial transaction data.
Detects Emirates Id patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Cuit Cuil patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Austria Tax Identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects Austria Value Added Tax (VAT) Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. VAT numbers have country-specific prefixes that aid detection accuracy.
Detects Australian Financial Services Licence (AFSL) numbers issued by ASIC to authorised financial services providers.
Detects Australian Director Identification Numbers (director IDs / DIN) issued by the Australian Business Registry Services (ABRS). A director ID is a 15-digit number beginning with Australia's ISO 3166 country code 036, followed by an 11-digit unique identifier and a single check digit, often written with spaces or hyphens between groups.
Identifies Australian Bank State Branch (BSB) routing codes in 3-digit dash 3-digit or continuous 6-digit formats. Supports space separator. Requires corroborative financial-institution keywords.
Detects Australian Business Numbers (ABNs), which are unique 11-digit identifiers issued by the Australian Business Register to entities carrying on a business in Australia. ABNs are commonly formatted as groups of 2-3-3-3 digits separated by spaces or hyphens. The ABN includes a check digit mechanism, but this pattern relies on format matching combined with corroborative evidence rather than algorithmic validation.
Identifies references to Australian consumer deposit account numbers in financial and compliance documents. Uses structural anchors with proximity constraints.
Detects Australian OTC electricity derivative and power purchase agreement confirmation content - documentation under the June 2006 Australian Electricity Addendum and 2005 ISDA Commodity Definitions, electricity swap/cap/floor/swaption confirmations settled against the AEMO regional reference price, and PPA confirmation phrasing with $/MWh fixed prices.
Populated beneficiary and dependant nominations held by superannuation funds and employers: binding and non-binding (including lapsing and non-lapsing) death benefit nominations under Superannuation Industry (Supervision) Regulations 1994 reg 6.17A (made for SIS Act 1993 s 59(1A)), employer group life insurance beneficiary nominations, and HR dependant, next-of-kin and emergency contact records. Each record ties an identified member or employee to named family members, their relationship to the member and, on death benefit forms, the share each person receives, witness details and dates of birth. Bulk member extracts with TFNs and balances belong to superannuation-fund-member-statement-bulk, and super identifiers (USI, member number) on their own belong to global-top500-096-superannuation-identifiers.
Detects financial statements including profit and loss, balance sheets, and income statements.
Detects Australian electricity forward/broker curve exports - forward or broker curve phrasing tied to NEM regional reference identifiers (QLD1, NSW1, VIC1, SA1, TAS1), load shape terms (flat/peak/off-peak), or calendar/quarter strip notation (Cal27, Q1-27, CY2027, FY27) with $/MWh values. Internal curve marks reveal a participant's price expectations and valuation basis.
Detects populated Australian loan agreements and credit contracts: a loan agreement / credit contract / loan facility phrase combined with named borrower or lender fields, a stated loan amount or repayment, or a loan/facility reference number. Phrase-only mentions stay discovery-only.
Identifies Australian Medicare card numbers (10-11 digits, first digit 2-6). Filters same-digit sequences. Requires corroborative health-scheme keywords for reliable detection.
Detects Australian Medicare card numbers, which are issued to Australian citizens and permanent residents for access to subsidised healthcare under the Medicare system. The number consists of 10 digits: the first digit is between 2 and 6, followed by 8 additional digits and a single check digit. Numbers are commonly formatted as groups of 4-5-1 digits separated by spaces or hyphens.
Detects Medicare Provider Number patterns. An 8-character code consisting of 6 digits, a location character, and a check character. Validated by location and check character sets.
Detects populated Australian mortgage documents (mortgage deeds, home loan contracts, registered mortgages, discharges): the mortgage phrase combined with named mortgagor/mortgagee fields, a security property or title reference, or a secured loan amount. Phrase-only mentions stay discovery-only.
Detects Queensland blue card (working with children check) applications, renewals and screening outcomes for a named applicant - blue card application or renewal records, positive or negative notices and exemption cards - when the phrase sits with populated applicant identifiers and application fields.
Detects QLD Bond Loan applications for rental assistance and financial hardship support.
Council-issued infringement notices for local law and animal management offences, and the default certificates and referral records that send unpaid notices to the State Penalties Enforcement Registry (SPER). Under State Penalties Enforcement Act 1999 s 15, an infringement notice must state a unique number for the notice, its date, the alleged offender's full name and address, the offence particulars (place, time and date, and identifying particulars for any animal or vehicle), and the fine. s 22 and s 23 set out payment, court election and instalments within 28 days. When the alleged offender defaults, the administering authority may give SPER a default certificate (s 33), and SPER may then issue an enforcement order (s 38). Council compliance and remedial notices (Local Government Act 2009 s 138AA) often precede the infringement. Local law registers are public, but individual notices and SPER referral batches are not.
Queensland local government records about overdue rates and charges and the sale of land to recover them under Local Government Regulation 2012 ch 4 pt 12: arrears ledgers and debt recovery referrals (s 132 overdue rates, s 133 interest on overdue rates), and notices of intention to sell land for overdue rates or charges (s 140), which must state the resolution date and terms, the land as shown in the land record, the overdue amount including the period unpaid, and the interest owing. Sale procedures follow in ss 141-146. These records tie a named owner, a rates assessment or property number and a land description to that owner's arrears. The auction notice that s 142 requires councils to publish is public and is a decoy.
Detects QLD Government tender documents including procurement evaluations, pricing schedules, and evaluation criteria.
Detects populated Queensland social / public housing applications and housing register records: a housing application or housing register phrase combined with a named applicant or household member, household income, household size or current address. Phrase-only mentions stay discovery-only.
Detects Australian Superannuation Fund Number (RSE) patterns. An R prefix followed by 7 digits, registered with APRA.
Detects Australian tax invoices containing GST, ABN, and payment details as required by ATO regulations.
Identifies Australian Tax File Numbers (TFNs) — unique nine-digit identifiers issued by the Australian Taxation Office. Uses an inline mod-11 Checksum validator with AllDigitsSameFilter and TextMatchFilter to exclude known test values.
Detects Working With Children Check (WWCC) clearance numbers across Australian states. Covers the NSW structural format (WWC + 7 digits + check letter, e.g. WWC1234567E) and the labelled VIC / WA / generic forms where a WWCC or working-with-children phrase precedes a card or clearance number. The Queensland Blue Card is handled by a separate classifier.
Detects government bank account details (BSB + account number) combined with payment authorisation credentials, approval tokens, or signing authorities that together enable the initiation of payments.
Detects Belgium Value Added Tax Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. VAT numbers have country-specific prefixes that aid detection accuracy.
Detects Brazilian PIX keys in email, +55 mobile, or EVP UUID forms.
Detects Canada Bank Account Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Financial account numbers require corroborative evidence for reliable detection due to their generic numeric format.
Detects Canada Revenue Agency (CRA) Business Numbers (BN). The core BN is nine digits assigned to a business. Program accounts append a two-letter program identifier (RC, RM, RP, or RT) and a four-digit reference, for example 123456789RC0001 for a corporate income-tax account.
Detects North American Numbering Plan (NANP) telephone numbers in Canadian contexts: the domestic NPA-NXX-XXXX form (bracketed, hyphenated, dotted, spaced, or bare, with an optional leading trunk "1") and the international +1 NPA-NXX-XXXX form. Area-code (NPA) and exchange-code (NXX) groups are constrained to a leading digit of 2-9 with the N11 service-code shape (211/311/411/511/611/711/811/911) excluded from both groups, per NANPA's published format rules. This pattern is structurally identical to us-phone-number because NANP area codes are drawn from a single pool shared by the US, Canada, and Caribbean member territories — the digit sequence itself cannot distinguish a Canadian number from a US one. This is the sibling of us-phone-number; the two are differentiated by jurisdiction/regulation metadata and country-specific corroborative evidence keywords only, not by regex — see us-phone-number's description for the documented family convention.
Detects financial submissions to the QLD Cabinet Budget Review Committee (CBRC) containing agency funding bids, savings proposals, capital expenditure requests, and fiscal strategy options.
Detects draft monetary policy decisions and pre-announcement rate recommendations: a rate value (percentage, basis points or per cent) near a central bank / Reserve Bank reference and a recommendation line proposing a rate action. Published RBA statements, media commentary and forecasts are excluded.
Detects Mainland China Unified Social Credit Codes (统一社会信用代码) assigned to legal persons and other organisations. The code is 18 characters using a restricted alphabet (digits and selected letters excluding I, O, Z, S, V), with an embedded administrative division code in positions 3-8.
Detects Colombia Tax Identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects financial models for mergers, acquisitions, or divestments containing actual valuations, synergy estimates, deal structures, and price ranges. Disclosure constitutes insider information under securities law.
Detects Cyprus Tax Identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects German mobile telephone numbers per the Bundesnetzagentur's (BNetzA) Nummernplan für Mobile Dienste: the (0)15, (0)16, and (0)17 mobile sub-ranges, in both the domestic (leading trunk "0") and international (+49, leading 0 dropped) forms. BNetzA's own published length table shows the national significant number (the digits after the leading 0, including the "1" of "15/16/17") is 10 digits for most 016x/017x allocations and 11 digits for the 015x range and the 1609/176 exceptions — every quantifier below is bounded to this documented 10-11 digit span rather than left open-ended. The 10-11 bound is applied as a single envelope across all three ranges (the regex cannot pin 015x to exactly 11 and non-exception 016x/017x to exactly 10 without per-sub-range length alternation), so a 10-digit 015x or an 11-digit non-exception 016x/017x rendering is accepted — a deliberate, documented over-acceptance kept small by the envelope itself. Beyond the DIN 5008:2020 space-grouped form, two widespread legacy DIN 5008 renderings of the mobile prefix are covered: the slash form "0171/3920045" and the parenthesised form "(0171) 3920045" — both deprecated by the current DIN 5008 (which prescribes plain space grouping) but still common in signatures and letterheads — plus the "+49 (0)171 ..." letterhead form (nonstandard per ITU-T E.123, but ubiquitous). Geographic (Ortsnetz) landline numbers are intentionally out of scope (so the landline renderings "030/12345678" and "(030) 12345678" are likewise not matched): BNetzA states area codes run 2-5 digits and new allocations are capped at 11 significant digits (10 for the Berlin/Hamburg/Frankfurt/Munich two-digit-code exception), but does not publish a verified minimum length for the existing stock of legacy numbers, so a low-end bound would be invented rather than sourced — mirroring in-phone-number's decision to scope out India's similarly under-specified STD/landline numbers.
Detects Steuer Id patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Germany Value Added Tax Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. VAT numbers have country-specific prefixes that aid detection accuracy.
Detects Spanish national telephone numbers per Spain's closed 9-digit numbering plan (Plan Nacional de Numeración Telefónica, administered under CNMC oversight): mobile numbers (segment N=6 in full, plus N=7 partially opened for mobile use in the 71/72/73/74 sub-ranges by the SETSI Resolución de 12 de marzo de 2010, BOE-A-2010-5251; the first 7-prefixed mobile numbers entered service from late 2010/2011 once the then-regulator CMT assigned the new ranges to operators) and geographic numbers (leading 8 or 9, with the second digit constrained to never be 0 — a constraint that incidentally excludes the 900/901/902/905 toll-free and premium-rate service ranges, whose second digit is 0). Spain has no domestic trunk prefix, so the +34 international form carries the same 9 significant digits as the domestic form, just with the +34 prefix in place of nothing.
Detects Spain Tax Identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects EU declarations of conformity for high-risk AI systems under Article 47 and Annex V of the EU AI Act (Regulation (EU) 2024/1689). By drawing up the declaration the provider assumes responsibility for compliance; pre-signature drafts and the surrounding conformity-assessment correspondence reveal the provider's compliance posture, notified-body findings, and certificate details before market placement.
Detects deployer-side fundamental rights impact assessments (FRIA) under Article 27 of the EU AI Act (Regulation (EU) 2024/1689). A FRIA is performed before deploying certain high-risk AI systems by public bodies, private providers of public services, and deployers of credit-scoring and life/health-insurance pricing systems (Annex III points 5(b) and (c)). Completed FRIAs contain candid assessments of risks of harm to specific categories of natural persons and are sensitive before notification and remediation.
Detects Article 11 / Annex IV technical documentation for high-risk AI systems under the EU AI Act (Regulation (EU) 2024/1689). This documentation must demonstrate compliance of the high-risk AI system before placing on the market and contains commercially sensitive material — system architecture, design specifications, training-data datasheets, risk management findings, and known limitations — whose uncontrolled disclosure exposes trade secrets and the provider's compliance posture.
Detects European debit and credit card numbers for Visa, Mastercard, and American Express networks. The pattern matches 13- to 16-digit card numbers based on the leading digits assigned to each network by the ISO/IEC 7812 standard. This is commonly used for PCI-DSS compliance scanning across EU-regulated financial data.
Detects DORA Article 6 ICT risk management framework documentation and the digital operational resilience strategy of financial entities — board-approved framework documents, risk tolerance statements, and internal audit reviews of the framework. These documents describe the entity's defensive architecture, control gaps, and risk appetite; disclosure hands attackers a map of weaknesses.
Detects DORA Article 19 major ICT-related incident reports — the initial notification, intermediate report, and final report submitted to the competent authority under Delegated Regulation (EU) 2025/301 and Implementing Regulation (EU) 2025/302 — and voluntary notifications of significant cyber threats. These reports detail live vulnerabilities, affected services, and root causes; premature disclosure aids attackers and can move markets.
Detects extracts and working copies of the DORA Article 28(3) register of information on contractual arrangements with ICT third-party service providers, including the ESAs' Implementing Regulation (EU) 2024/2956 template content (contractual arrangement reference numbers, provider LEIs, ICT service supply chain, critical or important function flags). The register maps a financial entity's entire ICT outsourcing estate and its concentration risk; disclosure exposes supplier dependencies and attack surface.
Detects International Bank Account Numbers (IBANs) used across European and global banking systems. IBANs consist of a two-letter country code, two check digits, and up to 30 alphanumeric characters representing the domestic bank account number. This pattern matches IBANs with or without space or hyphen delimiters between digit groups.
Detects EU Tax Identification Number (TIN) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. EU TIN formats vary by member state; this keyword list provides tax-related terminology for supplementary matching across EU jurisdictions.
Detects EU VAT identification numbers for all 27 member states in a single consolidated pattern, built branch-by-branch from the per-country structures published in the European Commission VIES FAQ (Q11). Covers the Greek quirk (Greece prefixes with EL, not GR) and Northern Ireland's XI prefix, which remains checkable in VIES for goods traders under the Windsor Framework — XI is included with the UK 9-digit, 12-digit and GD/HA government/health-authority forms; plain GB numbers are NOT included because Great Britain left the VIES scheme after Brexit. This pattern is a superset alongside the existing per-country detectors (at/be/de/fr/hu/it-vat-number), which stay untouched for deployed-GUID stability — the same document may fire both, following the global-iban / eu-iban precedent.
Detects French national telephone numbers per ARCEP's numbering plan: 10-digit numbers in the "0X XX XX XX XX" form covering geographic (01-05), mobile/personal (06-07), and polyvalent (09) leading digits, plus the +33 international form (10-digit domestic number with the leading 0 dropped, per ARCEP convention), including the widespread "+33 (0)6 39 98 45 67" letterhead rendering (a common-but-nonstandard practice — ITU-T E.123 advises against the parenthesised trunk digit in international notation, but it is ubiquitous on French letterheads and email signatures, so it is matched for detection purposes). The 09 polyvalent range is in scope because it is predominantly personal PII in practice: 09 is the standard residential VoIP home-line range, auto-issued with consumer internet boxes to millions of French households; only the small 0937-0939 sub-range carries ARCEP's newer "technical platform" category (app-to-driver ephemeral numbers and similar). Numbers beginning 08 (value-added services) remain intentionally out of scope — organizational/service numbers rather than personal PII, mirroring how uk-phone-number scopes out non-geographic service ranges.
Detects France Tax Identification Number (numéro SPI.) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects France Value Added Tax Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. VAT numbers have country-specific prefixes that aid detection accuracy.
Detects a BIP-39 mnemonic (crypto wallet recovery / seed phrase): a run of 11-24 space-separated lowercase words. Because the full 2048-word BIP-39 list cannot be embedded in a single regex, detection fires either when the word run is explicitly labelled as a seed/mnemonic/recovery phrase, or when the run contains one of a set of distinctive BIP-39 anchor words. A leaked seed phrase grants full, irreversible control of the wallet's funds.
Detects Bitcoin payment address candidates in both Bech32 (bc1…) and legacy Base58 (1…/3…) shapes. Checksums are not validated (Purview custom SITs lack Bech32/Base58Check functions), so matches are structural candidates and require Bitcoin/transfer context at enforce tiers.
Detects Braintree (PayPal) OAuth access tokens, which use a distinctive literal dollar-delimited structure: access_token$<environment>$<merchant-id>$<token>. A leaked token allows payment processing and transaction-history access on the connected merchant's behalf.
Detects budget proposals, financial forecasts, and expenditure planning documents.
Detects a labelled card verification value: a CVV / CVV2 / CVC / CVC2 / CID / CSC keyword (or the spelled-out "card verification value/code" / "card security code") immediately followed by a 3 or 4 digit value. The CVV is sensitive authentication data that PCI DSS 4.0 Requirement 3.3.1 prohibits storing after authorization.
Detects Cardano Shelley-era payment addresses: bech32-encoded with the mainnet human-readable prefix "addr1" (CIP-19 / CIP-5). The bech32 body varies with address type — enterprise (payment only) ~53 body chars, base (payment + stake) ~98 body chars, pointer in between — so the total ranges roughly 58-103 characters. The distinctive "addr1" prefix plus a long bech32 body is strong structure, gated at 85. Legacy Byron base58 (Ae2.../DdzFF...) and reward "stake1" addresses are not implemented (see report). Prefix/lengths verified against the CIP-19 test vectors.
Detects commercial lease agreements containing premises details, rental terms, and tenant obligations.
Detects DigitalOcean personal access tokens (dop_v1_ prefix). These tokens authenticate to the DigitalOcean API and can manage droplets, databases, DNS and billing; a leak enables full account control.
Detects direct debit requests, BECS authorizations, and recurring payment arrangements under Australian banking standards.
Detects Dogecoin mainnet addresses: Base58Check encoded, 34 characters long. Pay-to-Public-Key-Hash (P2PKH) addresses use version byte 0x1E and start with "D"; Pay-to-Script-Hash (P2SH) addresses use version byte 0x16 (22) and start with "A" (leading "9" is also possible for that version byte). A single leading letter is weak structure, so detection is context-gated. Prefix/version/length verified against libdogecoin and Dogecoin address-type docs.
Detects Department of Veterans' Affairs (DVA) file numbers used to identify Australian veterans and eligible dependants for health and support services.
Detects Ethereum Address patterns.
Detects populated guarantee and indemnity instruments (personal/corporate/continuing guarantees, deeds of guarantee, guarantor agreements) that name the guarantor or borrower, state a guaranteed amount or limit, or carry an ABN/ACN. Phrase-only mentions stay discovery-only.
Detects Heroku platform API keys in the prefixed HRKU- form. These keys authenticate to the Heroku Platform API and can deploy apps, read config vars and manage add-ons; a leak enables full account compromise.
Detects Hugging Face user access tokens (hf_ prefix), used to authenticate to the Hugging Face Hub API. A leaked token grants access to private models, datasets and Spaces, and can incur inference billing.
Detects International Bank Account Numbers (IBANs) across the full ISO 13616 / SWIFT IBAN Registry country set, extending coverage beyond the EU-focused eu-iban pattern to non-EU IBAN countries verified against the SWIFT IBAN registry — at minimum United Kingdom (GB, 22 chars), Switzerland (CH, 21), Norway (NO, 15), Saudi Arabia (SA, 24), United Arab Emirates (AE, 23), and Turkey (TR, 26). The structural regex widens eu-iban's BBAN length range (12-36 alphanumeric characters) down to 8-32 specifically to also catch shorter formats such as Norway's 15-character IBAN (11-character BBAN), which falls below eu-iban's minimum and would not match it. This pattern intentionally co-fires with eu-iban for EU country codes, since neither pattern restricts the 2-letter prefix to a specific country allow-list — see false_positives.
Detects ISO 17442 Legal Entity Identifiers (LEIs) — the 20-character uppercase alphanumeric codes issued under the Global LEI System (GLEIF) that uniquely identify legal entities in financial transactions. Structure: characters 1-4 are the LEI-issuer (LOU) prefix, characters 5-6 are reserved and set to "00", characters 7-18 are the entity-specific part, and characters 19-20 are numeric check digits (ISO 7064 MOD 97-10). Requiring the literal "00" at positions 5-6 and two digits at positions 19-20 makes the format far more distinctive than a generic 20-character alphanumeric run. Known recall cost: pre-2013 CICI-era legacy LEIs — interim identifiers issued before the "00" reservation, grandfathered into the GLEIF system and still live and checksum-valid — do not carry "00" at positions 5-6 and are NOT matched. This class includes major counterparties such as Microsoft (INR2EJN1ERAN0W5ZP974), Deutsche Bank (7LTWFZYICNSX8D621K86) and Apple (HWUPKR0MPOU8FGXBT394), so documents dealing with such entities' LEIs will be missed. This is a deliberate precision-over-recall trade-off: dropping the "00" anchor would widen the pattern to any 20-character uppercase alphanumeric run ending in two digits.
Detects Litecoin addresses in two forms. Native SegWit bech32 addresses use the human-readable part "ltc1" (distinctive, 85-gated). Legacy base58 addresses are P2PKH with version byte 0x30 (leading "L") and P2SH with version byte 0x32 (leading "M"), 26-35 characters (most 34) — a single-letter prefix that is weaker (75-gated). Prefixes/version bytes/lengths verified against the Litecoin address-prefix docs and documented example addresses.
Detects Monero (XMR) public addresses, encoded in Monero-specific base58 (same 58-character alphabet as standard base58, excluding 0 O I l). Standard addresses (mainnet network byte 18) and subaddresses (network byte 42) are 95 characters and begin with "4" or "8"; integrated addresses (network byte 19, standard address + encrypted 64-bit payment ID) are 106 characters and begin with "4". The fixed 95/106-char length is highly distinctive, gated at 85. Prefixes/lengths verified against the Monero standard-address and integrated-address docs.
Detects National Metering Identifier (NMI) patterns used in the Australian energy market. A 10 or 11 digit number identifying electricity and gas connection points. Also covers the gas Meter Installation Registration Number (MIRN), which is allocated in the NMI number space: AEMO reserves the 5 XXX XXX XXX range for the gas industry (NSW/ACT 52, Vic 53, Qld 54, SA 55, WA 56, Tas 57) and MIRNs travel in the same aseXML NMI element with a checksum attribute. Context-dependent: requires energy/meter keywords.
Detects Australian PayID payment addresses used on the New Payments Platform (NPP). A PayID is an email address, mobile phone number (+61 / 04xx format), ABN or organisation identifier registered as a real-time payment alias, detected when it appears near an explicit PayID label in a payment context.
Identifies payment card Primary Account Numbers (PANs) for Visa, Mastercard (including 2-series BINs), American Express, Discover, JCB, Diners Club and UnionPay, in contiguous and space/hyphen-separated forms. Uses Func_credit_card Luhn validator with AllDigitsSameFilter.
Detects ISO/IEC 7813 magnetic-stripe Track 1 (format code B) data for payment cards: a start sentinel %B, the primary account number, the cardholder name, expiry date, service code and discretionary data. Storing full track data after authorization is prohibited by PCI DSS 4.0 Requirement 3.3.1.
Detects ISO/IEC 7813 magnetic-stripe Track 2 data for payment cards: a start sentinel ;, the primary account number, a field separator =, expiry (YYMM), service code and discretionary data, end sentinel ?. Also detects the common no-sentinel database form PAN=YYMM... Storing full track data after authorization is prohibited by PCI DSS 4.0 Requirement 3.3.1.
Detects payment advices, remittance notices, and electronic funds transfer confirmations.
Detects international telephone numbers in ITU-T E.164 form: a leading "+" (the international prefix symbol defined by ITU-T E.123, the companion notation recommendation) followed by a country code and national significant number totalling no more than 15 digits, per E.164's own numbering-space limit (country code 1-3 digits, subscriber number up to 12 digits, 15 digits maximum overall). This pattern covers only the "+"-prefixed international representation — it is the global counterpart to the country-specific domestic-format patterns (us-phone-number, ca-phone-number, uk-phone-number, in-phone-number, and the EU national patterns), which additionally match each country's bare domestic formatting conventions. Real-world renderings commonly use spaces or hyphens between digit groups even though E.123 formally prescribes spaces only; both are accepted here. The "+CC (0)..." letterhead rendering (e.g. "+44 (0)20 7946 0958") is deliberately NOT matched by this pattern: it is not an E.164 representation (E.123 explicitly advises against the parenthesised trunk digit in international notation), and the country-specific patterns whose plans actually use a trunk 0 (uk/de/fr/nl) each cover it themselves — keeping this global pattern strictly E.164-shaped.
Detects Plaid API credentials: Item access tokens (access-sandbox-/access-production- followed by an RFC 4122 UUID) and, when labelled with Plaid context, the 30-character hex API secret. A leaked access token exposes a user's linked bank account data; a leaked secret compromises the whole Plaid integration.
Detects populated security agreements and PPSR registrations: a security agreement / PPSR / personal property securities phrase combined with a named grantor or secured party, a PPSR registration or financing statement number, or described collateral. Phrase-only mentions stay discovery-only.
Detects populated residential tenancy agreements (including Queensland Form 18a general tenancy agreements): the tenancy-agreement phrase combined with named tenant/lessor fields, a numbered premises address, a stated rent or bond amount, or a bond number. Phrase-only mentions stay discovery-only.
Detects the Shopify access-token family: Admin API access tokens (shpat_), custom app access tokens (shpca_), legacy private app passwords (shppa_) and app shared secrets (shpss_), each followed by a 32-character hex body. A leaked token grants API access to a Shopify store, including customers, orders and payment-adjacent data.
Detects Solana public wallet/account addresses: the base58 encoding of a 32-byte ed25519 public key, 32-44 characters long, with NO distinctive prefix. Because a prefix-less base58 run of this length collides heavily with random tokens, other base58 identifiers and prose, detection is context-gated: the single tier is AND-gated by cryptocurrency/wallet domain context and a template/sample noise exclusion. Length/charset bounds verified against the Solana account model (32-byte address displayed as a base58 string) and the base58 alphabet (excludes 0 O I l).
Detects Sarbanes-Oxley (SOX) and COSO internal control framework compliance documents.
Detects Square credential formats: application secrets (sq0csp-, with sandbox- prefixed sandbox variants), legacy personal access tokens (sq0atp-), and current OAuth/personal access tokens (EAAA + 60-character body, context-gated on a nearby Square label because the EAAA base64 shape also occurs in non-Square tokens and encoded blobs). A leaked token or secret enables payment processing and transaction data access in the associated Square account.
Detects populated internal strategic plans, product/technology roadmaps and business cases: the plan/roadmap/business-case phrase combined with document-control fields, dated roadmap milestones or financial targets. Public strategy statements and phrase-only mentions stay discovery-only.
Detects subscription agreements, recurring billing terms, and SaaS licence documentation.
Detects Swift Bic patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Identifies documents containing references to sim card identifiers in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Identifies documents containing references to equity grant details in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Detects employee payroll bank account details: a payroll/salary account or direct-deposit phrase combined with a BSB, a bank account number or a named employee/payee field. Phrase-only mentions (policies, scam warnings) stay discovery-only.
Detects completed employee tax withholding declarations and elections: ATO Tax file number declaration (NAT 3092) and withholding declaration (NAT 3093), US Form W-4 and UK starter checklist, with the payee identified and a TFN/SSN, residency or tax-free threshold answer, filing status or payer ABN.
Detects completed employer payroll tax and withholding filings: Queensland (state) payroll tax returns and annual reconciliations, PAYG withholding annual reports, Single Touch Payroll pay events/finalisation summaries and US Form 941/940 returns, with populated wage/withholding totals and an employer identifier or reporting period.
Detects completed employee tax and superannuation forms: PAYG payment summaries and employee income statements, superannuation standard choice form (NAT 13080), US Form W-2 and UK P60/P45, with the payee identified and TFN/SSN, gross payments or tax withheld amounts, USI/member number, payer ABN or financial year.
Detects completed contractor tax forms and reports: ATO taxable payments annual report (TPAR) rows, PAYG withholding voluntary agreements, statements by a supplier (no-ABN withholding), US Form 1099-NEC/W-9 and contractor payment statements, with a named payee plus payment amounts or ABN.
Detects payroll deduction records for an identified employee: deduction authorisations, salary sacrifice agreements, union fee, child support, health fund, workplace giving and novated lease deductions, with the deduction amount.
Detects wage garnishee notices and earnings attachment orders served on an employer for an identified employee: ATO garnishee notices (TAA 1953 Sch 1 s 260-5), Services Australia child support and debt garnishee notices, court attachment of earnings / income withholding orders, with the amount owing or amount to deduct.
Detects superannuation / retirement contribution records for an identified employee or member: SG and salary sacrifice contribution reports, SuperStream contribution files, employer pension contribution schedules and 401(k) contribution records, with contribution amounts.
Detects pension, annuity and retirement income stream account identifiers: a labelled pension/annuity/policy/member number with a populated value, optionally with the account holder name or date of birth.
Detects dependant-related tax credit and family benefit claims for an identified person: Family Tax Benefit claims, dependant (invalid and carer) tax offset claims, US child tax credit / Schedule 8812, with dependant names or dates of birth, number of children or claimed amounts.
Detects employee childcare benefit claims processed through payroll: childcare salary packaging and reimbursement claims, employer-sponsored childcare applications and dependent care FSA reimbursements, with the child or provider details and claimed amounts.
Detects employee expense reimbursement claims: expense claim forms, travel claims and acquittals, mileage and per diem claims and corporate card acquittals for an identified claimant, with itemised or total amounts.
Detects payroll journal postings: pay-run journals, wages journals, payroll accruals and payroll GL exports with populated ledger lines (wages expense, PAYG withholding payable, superannuation payable, net wages payable, payroll clearing) and a journal reference or posting/period date. Aggregate ledger data, capped at 75.
Detects correspondence from a tax authority to an identified taxpayer: ATO notices of (amended) assessment, audit and review letters, QRO notices, IRS CP notices and HMRC letters, with taxpayer identifiers and amounts payable, penalties or response dates.
Detects payroll exception and variance reports that list identified employees: pay run exception reports, payroll variance/error reports and pre-pay-run validation reports with the exception reason or pay amounts.
Detects Australian superannuation identifiers with populated values: USI (unique superannuation identifier), fund member/account numbers, fund or SMSF ABN and SMSF electronic service address (ESA), optionally with the member or employee name.
Detects salary and wage overpayment recovery records for an identified employee: overpayment notifications, recovery letters and repayment agreements, with the overpaid amount, repayment instalments or overpayment period.
Detects off-cycle and ad hoc payroll payment requests and approvals for an identified employee: off-cycle pay requests, manual/special pay runs, final pay and termination pay calculations, with payment amounts or payment date.
Detects compensation arrears and back-pay records for an identified employee: salary/wage arrears calculations, back-pay schedules, underpayment remediation calculations and retrospective pay increases, with arrears amounts or arrears periods.
Detects exported payroll system access and audit logs: timestamped log lines showing a user logging in, viewing, changing or exporting payroll records, with a populated user field. Operational security data, capped at 75.
Detects references to consumer bank account numbers in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
Detects references to bank routing numbers in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to IBAN and international bank account number topics in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation. Topic-level phrase detection only; it does not parse or mod-97-validate IBAN values.
Detects references to SWIFT or BIC codes in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation. Phrase-level payment-rail concept detection anchored on explicit SWIFT/BIC vocabulary; it does not parse 8- or 11-character BIC values.
Detects references to payment card primary account numbers in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to card verification values in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation. Phrase-level concept detection anchored on explicit card-verification vocabulary; it does not parse 3- or 4-digit CVV values.
Detects references to card expiration dates in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation. Phrase-level concept detection anchored on card-specific expiry vocabulary; it does not parse MM/YY or month-year values.
Detects references to cardholder names linked to accounts in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to mobile payment account ids in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to merchant acquiring credentials in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
Detects references to direct debit mandate data in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to ach company and originator ids in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to remittance instructions in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
Detects references to card dispute case records in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to wire transfer instructions in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
Detects references to escrow account details in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to treasury cash position reports in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to cash flow forecast assumptions in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to payment fraud investigation files in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
Detects references to credit bureau reports in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
Detects references to credit scores in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
Detects references to loan application files in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to mortgage underwriting packets in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to collateral valuation reports in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to debt collection records in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
Detects references to bankruptcy case records in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to insurance policy records in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
Detects references to insurance claim records in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to underwriting decision rationales in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
Detects references to know-your-customer profiles in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
Detects references to anti-money-laundering alerts in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
Detects references to suspicious activity reports in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
Detects references to sanctions screening matches in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to beneficial ownership declarations in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
Detects references to guarantor identity and financial data in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to loan covenant compliance records in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to reinsurance contract terms in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
Detects references to premium payment histories in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to claim settlement negotiation notes in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects supplier/vendor bank detail change requests - the payment-redirection pattern behind business email compromise: a bank-detail change phrase combined with a BSB, a bank account number, a named supplier/payee or a vendor number/ABN. Phrase-only mentions (scam warnings, AP procedures) stay discovery-only.
Identifies documents containing references to supplier invoice records in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Identifies documents containing references to tax exemption certificates in international contexts. These are tax-compliance certificates that may contain entity or individual identifiers; the category is not blanket personally identifiable information.
Identifies documents containing references to market entry strategy papers in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Identifies hospital billing records references in healthcare and patient records. Protected health information under applicable data protection regulations.
Identifies individual student financial aid applications - financial aid applications and award packages, student aid or loan applications, FAFSA, scholarship and bursary applications, fee waiver requests and hardship grant applications - when the phrase sits with populated applicant identifiers and household-finance fields. Financial and education records under applicable privacy law.
Identifies documents containing references to invoice and payment history in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Identifies documents containing references to pre-release national budget drafts in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
Identifies documents containing references to central bank intervention plans in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
Detects TRON (TRX) mainnet addresses: Base58Check encoding of a 21-byte payload (0x41 version byte + 20-byte address hash), always starting with the letter "T" and exactly 34 characters long. The 0x41 prefix byte fixes the leading character as "T" and the length at 34 (58^34 > 66*256^24; 58^33 insufficient). A single leading letter is weak structure, so detection is context-gated. Prefix/length/charset verified against TRON developer docs and the TRON protocol overview.
Detects XRP Ledger classic addresses: base58-encoded, starting with the character "r", 25-35 characters long, encoding a 21-byte buffer (1-byte prefix value 0 + 160-bit account ID) with a 4-byte checksum. The XRP base58 dictionary excludes 0, capital O, capital I and lowercase l — the same 58-character set as standard base58, so a standard base58 class matches the charset. A single leading letter is weak structure, so detection is context-gated. Length/charset/prefix verified against xrpl.org address docs.
Detects internal or QAO (Queensland Audit Office) audit findings identifying material weaknesses in financial controls before public tabling. Disclosure enables exploitation of identified control gaps.
Detects whole-of-government or agency-level insurance coverage schedules, self-insurance reserves, indemnity limits, and excess/deductible structures, and quantified contract liability and insurance schedules (liability caps, limits of liability, required professional indemnity and public liability cover), that reveal the State's financial exposure limits. Absorbed global-top500-178-indemnity-and-liability-schedules (2026-09-24).
Detects sealed pricing schedules submitted by tenderers as part of government procurement processes, held in confidence until evaluation is complete.
Detects internal government revenue projections including tax revenue, royalties, mining/gas receipts, and stamp duty forecasts before public release in budget papers or MYFER.
Detects Greek Tax identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects internal scoring sheets, panellist rankings, weighted criteria assessments, and funding recommendations for competitive government grant programs before public announcement.
Detects Hungary Tax identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects Hungarian Value Added Tax Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. VAT numbers have country-specific prefixes that aid detection accuracy.
Detects Indonesian taxpayer identification numbers (NPWP). Classic NPWP is 15 digits commonly formatted 01.234.567.8-012.000; newer 16-digit forms align with NIK for individuals under tax reform.
Detects Israel Bank Account Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Financial account numbers require corroborative evidence for reliable detection due to their generic numeric format.
Detects India GST Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects Indian Financial System Codes (IFSC) used to identify bank branches on the NEFT/RTGS/IMPS networks. Format is four letters (bank code), a mandatory zero, then six alphanumeric characters (branch code), total length 11, typically uppercase.
Detects PAN patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Indian mobile telephone numbers per the Department of Telecommunications' National Numbering Plan 2003 (as amended): 10-digit mobile numbers with a constrained leading digit (6-9, expanded from 7-9 to include 6 when DoT authorized 6-series allocation in 2017), in both the bare domestic form and the +91 international form (leading 0 dropped). Landline/STD (Subscriber Trunk Dialling) numbers are intentionally out of scope: STD codes vary 2-8 digits with no verified structural rule constraining their leading digit, so a regex loose enough to cover them (just "10 digits after a leading 0") would be barely tighter than matching any 11-digit sequence — far too high a digit-collision risk to ship without a genuinely verified constraint. See false_positives.
Detects Employees Provident Fund Organisation (EPFO) Universal Account Numbers (UAN). UAN is a 12-digit number assigned to employees to link multiple PF member IDs across employers. Leading digit is non-zero.
Detects Unified Payments Interface (UPI) Virtual Payment Addresses (VPA / UPI ID) used in India. Format is a local part and a payment-service provider handle separated by @ (for example name@oksbi or business@ybl). Handles are alphabetic PSP codes; local parts allow letters, digits, dot, underscore and hyphen.
Detects Italian mobile telephone numbers per AGCOM's national numbering plan (Delibera n. 8/15/CIR, Allegato A): the mobile/personal-communications block, structurally defined as "3XYZ" plus six further digits (a 10-digit total for numbering assigned under the current plan), in both the domestic and +39 international forms. The delibera permits already-assigned legacy 9-digit mobile numbering to persist, so any surviving legacy 9-digit mobile numbers are a known potential false negative of this 10-digit regex — kept at 10 digits deliberately, since evidence that live 9-digit stock persists today is inconclusive and loosening the length bound would raise digit collision for every match. Geographic (landline) numbers are intentionally out of scope: the AGCOM plan family bounds geographic numbers at a 10-11 digit total (11 maximum), but within that bound the "0" block's second digit is structurally unconstrained and the minimum/per-prefix length variability across the legacy short-number stock is not verified from a primary source — a 0-prefixed regex spanning that length range with no second-digit constraint would be highly collision-prone — and Italian landline numbers are also the one well-known exception where the leading 0 is retained even in the +39 international form, a further formatting axis to model. Mobile numbers carry no such leading-0 quirk (they never had a leading 0 to begin with).
Detects Italy Value Added Tax Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. VAT numbers have country-specific prefixes that aid detection accuracy.
Detects Japan Bank Account Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Financial account numbers require corroborative evidence for reliable detection due to their generic numeric format.
Detects Japanese My Number Corporate patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. The Corporate Number (法人番号) is a 13-digit identifier assigned to corporations and organisations in Japan by the National Tax Agency.
Detects 在留カード番号 patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects legal opinions and due diligence reports for mergers, acquisitions, or privatisations involving Government Owned Corporations (GOCs) or government assets. Disclosure is market-sensitive and commercially prejudicial, potentially breaching continuous disclosure obligations.
Detects Malta Tax ID Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects Mexican CLABE (Clave Bancaria Estandarizada) numbers used for SPEI interbank transfers. CLABE is an 18-digit standardized bank account number including bank code, branch, account and check digit.
Detects Malaysian individual Tax Identification Numbers (TIN / Nombor Pengenalan Cukai) issued by the Inland Revenue Board of Malaysia (LHDN / HASiL). Since 2 January 2023 individual TINs use the prefix IG followed by 9-11 digits (11-13 characters total); the legacy individual prefixes SG (employment income) and OG (business income) with the same digit range remain in circulation in older records. Entity TINs (C, D, F, PT, TA and similar prefixes) are deliberately out of scope: single-letter prefixes over a digit run are too collision-prone and entity TINs are not personal data.
Detects BSN patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Dutch national telephone numbers per the ACM-administered numbering plan: 10-digit numbers (leading trunk 0 included) covering geographic numbers (area code first significant digit 1-5 or 7, e.g. 020 Amsterdam, 010 Rotterdam, 070 Den Haag) and mobile numbers (06 prefix), plus the +31 international form (leading 0 dropped), including the widespread "+31 (0)6 12345678" letterhead rendering (a common-but-nonstandard practice — ITU-T E.123 advises against the parenthesised trunk digit in international notation, but it is ubiquitous on Dutch letterheads, so it is matched for detection purposes). Numbers beginning 08 (0800 free-of-charge service numbers, 088 non-geographic business lines) and 09 (0900/0906/0909 premium-rate information numbers) are intentionally out of scope — these are organizational/service numbers rather than personal PII, mirroring how uk-phone-number and fr-phone-number scope out their own non-geographic service ranges. Note this also excludes the 085 and 091 location-independent subscriber ranges (VoIP numbers ACM makes available to individuals as well as businesses): a personal 085/091 VoIP line is therefore a known false negative, accepted because the 085/088/091 block is predominantly organizational in practice and cannot be split from it structurally.
Detects Netherlands Tax Identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects Netherlands Value Added Tax Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. VAT numbers have country-specific prefixes that aid detection accuracy.
Detects New Zealand bank account number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Financial account numbers require corroborative evidence for reliable detection due to their generic numeric format.
Detects New Zealand Inland Revenue number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects the New Zealand Government IN-CONFIDENCE protective marking under the Protective Security Requirements (PSR) classification system: endorsed forms (e.g. MEDICAL IN-CONFIDENCE, BUDGET: IN-CONFIDENCE), the legacy SEEMail bracket trigger-word convention ([IN-CONFIDENCE]), and the bare ALL-CAPS document-banner form. Regex logic verified against the official PSR Classification Handbook (protectivesecurity.govt.nz) and Cabinet Office Circular CO(08)1; matched case-sensitively.
Detects the New Zealand Government SENSITIVE protective marking under the Protective Security Requirements (PSR) classification system: the legacy SEEMail bracket trigger-word convention ([SENSITIVE]), endorsed forms (e.g. BUDGET SENSITIVE, COMMERCIAL: SENSITIVE, CABINET SENSITIVE), and the bare ALL-CAPS document-banner form gated by New Zealand government context. Regex logic verified against the official PSR Classification Handbook (protectivesecurity.govt.nz) and Cabinet Office Circular CO(08)1; matched case-sensitively.
Detects New Zealand Business Numbers (NZBNs) — the 13-digit universal business identifier administered by MBIE. Every NZBN is a GS1 Global Location Number (GLN): the first two digits are 94 (the GS1 prefix identifying New Zealand entities), the next ten digits are the business entity identifier, and the final digit is a GS1 mod-10 check digit. A bare 13-digit run has a phone-number-sized collision surface (NZ mobile/landline numbers, card fragments, timestamps), so every tier requires the number to be directly attached to an NZBN label — label-embedded-in-regex counts as label gating per the D1 decision record. There is deliberately no bare unlabelled tier.
Detects bulk payroll data files containing employee names, Tax File Numbers (TFNs), bank account details, and salary information. Disclosure enables mass identity theft, fraudulent tax returns, and targeted social engineering.
Detects Philippines Social Security System (SSS) numbers in the common dashed format ##-#######-# (10 digits total). Continuous digit forms are intentionally out of scope to reduce collision with other national identifiers.
Detects Philippine Taxpayer Identification Numbers (TIN) issued by the Bureau of Internal Revenue (BIR) under Section 236(j) of the National Internal Revenue Code. The base TIN is a 9-digit number (the 9th digit is a check digit), usually written XXX-XXX-XXX. Registered businesses append a branch code — historically 3 digits (000 for the head office, 12 digits total) and, since eBIRForms v7.9.6.0 (RMC No. 36-2026, April 2026), up to 5 digits (14 digits total).
Detects Poland Tax Identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects ministerial briefing notes or departmental submissions recommending specific grant funding decisions before public announcement.
Detects draft earnings guidance, profit warnings, or financial results before market disclosure. For QLD Government, this applies to GOCs subject to continuous disclosure obligations.
Detects weighted evaluation matrices scoring tender responses, including commercial pricing from multiple bidders in government procurement processes.
Detects Cartão de Cidadão patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Portugal Tax Identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects بطاقة الهوية القطرية patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects unreleased Queensland state budget allocation figures, forward estimates, and expenditure projections. These are market-moving documents that enable insider trading on government-linked securities if disclosed prematurely.
Detects Russian Taxpayer Identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects Sweden Tax Identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects NRIC patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Singapore Unique Entity Numbers (UEN) issued by ACRA and other agencies to businesses and other entities. Common forms are 8 or 9 digits plus a check letter (local companies) and the issued-year form TyyPQnnnnX / SyyPQnnnnX / RyyPQnnnnX used for other entities.
Detects Slovenia Tax Identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects QTC (Queensland Treasury Corporation) borrowing strategies, debt issuance timelines, yield curve management plans, and refinancing schedules. Premature disclosure enables bond market front-running.
Detects bulk superannuation member data including individual balances, employer contributions, TFN-linked records, and beneficiary nominations from government super schemes such as QSuper.
Detects the Turkish tax identification number (Vergi Kimlik Numarası, VKN) issued by the Turkish Revenue Administration (Gelir İdaresi Başkanlığı, GİB). The VKN is a 10-digit number structured as a 3-digit alpha group code (001-999), a 6-digit sequence number and a single check digit. Since 1 July 2006 Turkish citizens use their 11-digit T.C. Kimlik Numarası as their tax number (covered by the separate tr-national-id pattern); the 10-digit VKN remains the tax identifier for legal entities, ordinary partnerships, foreign legal entities and foreign nationals without a Foreign Identity Number.
Detects proprietary trading algorithms, quantitative investment strategies, or systematic risk models used by government investment vehicles such as QIC (Queensland Investment Corporation). This deployable record is the keyword/regex fallback detector (basis-points anchor with quantitative and proprietary-marker evidence); any trainable ML classifier is a separate tenant artifact with an external identity and is not represented in this record.
Detects the Ukrainian individual tax number — the registration number of the taxpayer's account card (РНОКПП / RNOKPP, historically called RNTRC or ІПН), assigned by the State Tax Service of Ukraine to every individual taxpayer in the State Register of Individuals – Taxpayers. Per the OECD AEOI TIN description for Ukraine, the RNOKPP is a ten-digit numerical code (no letters, hyphens, or other symbols) with structure XXXXXNNNNK: a 5-digit birth-date registration sequence, a 4-digit account-card sequence, and a control digit.
Detects UK Companies House company registration numbers (CRNs). A company number is always 8 characters: either 8 digits (England & Wales incorporations), a 2-letter jurisdiction/entity-type prefix followed by 6 digits (e.g. SC Scottish company, NI Northern Ireland company, OC/SO/NC LLPs, RC/SR/NR royal-charter bodies, FC overseas companies, OE overseas entities), or R0 + 6 digits (pre-partition Northern Ireland companies, registered under the R0 prefix). The prefix allow-list is taken from the Companies House Uniform Resource Identifiers (URI) Customer Guide plus the post-2011 additions CE/CS (charitable incorporated organisations), SG (Scottish qualifying partnerships), OE (Register of Overseas Entities, 2022), RS (registered societies, e.g. the live entry RS008375) and FE (further education / sixth form college corporations). Bare 8-digit runs collide heavily with invoice, order and account numbers, so the all-numeric form is only ever matched when directly attached to a company-number label; the more distinctive prefixed form additionally gets a keyword-gated tier without a directly-attached label. Two allow-list prefixes are excluded from that bare prefixed form because they collide with common document-number abbreviations — NO ("INVOICE NO123456") and SO (ERP sales-order numbers such as SO123456) — and are matched only via the label-attached regex.
Detects the UK Government Security Classifications Policy (GSCP) OFFICIAL classification and its -SENSITIVE marking, written OFFICIAL-SENSITIVE and applied immediately after the OFFICIAL classification per the current policy. Matches the verified structured "CLASSIFICATION - HANDLING INSTRUCTION[- DESCRIPTOR]" format (e.g. OFFICIAL-SENSITIVE - RECIPIENTS ONLY, OFFICIAL-SENSITIVE - COMMERCIAL) using the centrally-defined GSCP handling-instruction and descriptor vocabulary, the bare OFFICIAL-SENSITIVE banner, and — at a lower, UK-government-context gated tier — bare OFFICIAL alone, which is a common English word. Regex logic verified directly against the current Government Security Classifications Policy (gov.uk, version 2.0, August 2024); matched case-sensitively so ordinary lowercase English use of "official"/"official-sensitive" does not trigger it.
Detects UK national telephone numbers per Ofcom's National Telephone Numbering Plan: geographic numbers (01/02 prefix) and mobile numbers (07 prefix, second digit restricted to 1-5 or 7-9, plus the 07624 Isle of Man mobile range — the one mobile block inside the otherwise-excluded 076 radiopaging range, allocated to Isle of Man operators under the UK plan; 070 personal-numbering and the rest of 076 remain excluded), both as 11-digit domestic strings (leading 0 + 10 significant digits), plus the +44 international form (10 significant digits, leading 0 dropped per ITU/Ofcom convention). Digit groups after the initial prefix use a flexible per-digit optional separator rather than a single fixed grouping, because Ofcom's numbering plan allows multiple valid group-length conventions (4+6, 3+7, 2+8, 5+5) that vary by area. Two additional conventional renderings are covered: the parenthesised-area-code national notation for geographic numbers, e.g. "(020) 7946 0958" / "(01632) 960960" (ITU-T E.123 national notation, parentheses marking the optionally-dialled area code, for 2-5 digit area codes), and the widespread "+44 (0)20 7946 0958" letterhead form (a common-but-nonstandard practice — E.123 advises against the parenthesised trunk digit in international notation, but it is ubiquitous in UK signatures and letterheads, so it is matched for detection purposes). Non-geographic service numbers (03/08/09) are intentionally out of scope — they are typically organizational/service numbers rather than personal PII, mirroring how au-fixed-line-telephone scopes to geographic numbers only.
Detects the paired UK domestic bank sort code (6 digits, written XX-XX-XX, XX XX XX, or XXXXXX) and account number (8 digits) as they normally appear together in UK bank-detail blocks (invoices, remittance advice, payroll/BACS instructions). Both digit groups must be directly attached to their own label ("sort code" / "account number" or "a/c no") in either order — bare unlabelled 6- or 8-digit sequences are never matched, because unlabelled digit sequences of this length collide heavily with dates, phone extensions, invoice numbers, and other structured identifiers.
Detects Unique Taxpayer Reference patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects United Kingdom (and Northern Ireland XI) Value Added Tax registration numbers. Standard trader numbers are GB followed by 9 digits; branch traders use GB plus 12 digits; government departments use GBGD### and health authorities GBHA###. Northern Ireland post-Brexit issues XI-prefixed numbers with the same body formats. Matching is uppercase letter prefixes as issued by HMRC.
Detects Us ABA Routing patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects U.S. Bank Account Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Financial account numbers require corroborative evidence for reliable detection due to their generic numeric format.
Detects US Individual Taxpayer Identification Numbers (ITINs) issued by the IRS to individuals who are required to have a US taxpayer identification number but are not eligible for a Social Security Number. ITINs always begin with the digit 9, and the fourth and fifth digits fall in the range 70-99, distinguishing them from SSNs. The pattern matches both formatted (9XX-7X-XXXX) and unformatted (9XX7XXXXX) variants.
'Detects MBI patterns. Excluded letters: S, L, O, I, B, Z.' This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects North American Numbering Plan (NANP) telephone numbers in US contexts: the domestic NPA-NXX-XXXX form (bracketed, hyphenated, dotted, spaced, or bare, with an optional leading trunk "1") and the international +1 NPA-NXX-XXXX form. Area-code (NPA) and exchange-code (NXX) groups are constrained to a leading digit of 2-9 with the N11 service-code shape (211/311/411/511/611/711/811/911) excluded from both groups, per NANPA's published format rules. NANP area codes are drawn from a single pool shared by the US, Canada, and Caribbean member territories — the digit structure itself cannot distinguish a US number from a Canadian one (see ca-phone-number for the sibling pattern). Differentiation between the two patterns is by jurisdiction/regulation metadata and country-specific corroborative evidence keywords only, not by regex — this is the documented convention for the whole NANP pair.
Detects bulk payment authorisation files extracted from government ERP systems (SAP, Oracle, TechnologyOne) containing payee bank accounts, payment amounts, and authorisation codes for batch processing.
Detects South African income tax reference numbers (TIN) allocated by the South African Revenue Service (SARS) under section 24 of the Tax Administration Act, 2011. The number is ten digits, may only start with 0, 1, 2, 3 or 9, and its tenth digit is a check digit computed with a modulus-10 (Luhn-style) algorithm documented by SARS.