Sensitive fields

A sensitive field is a contact custom field whose values are encrypted at rest and never sent to the browser in a list or detail view. To read one, open a contact, find the field in the Custom Fields tab, and click Reveal — which works only if you hold the pii.view permission. Use this for data such as government IDs, health notes, or financial details you want kept out of casual view and logged when accessed.

Marking a field as sensitive

Sensitivity is a property of the field definition, set in /settings/custom-fields. Click Add field (or the pencil icon on an existing field), and check Sensitive (PII) in the dialog. The field then carries a sensitive tag in the Flags column of the custom fields table.

Any custom field type can be sensitive — text, number, date, single-select, multi-select, checkbox, URL, or email. The toggle changes how values are stored and read, not the field's type or its display name.

How sensitive values are stored

When a field is sensitive, its values are written to a separate encrypted store on the contact rather than the plaintext custom-field store. Each value is held as a ciphertext string, so the value never reaches the browser through a list view, a detail-sheet read, or the contacts CSV export. A given value lives in exactly one store: the plaintext store for ordinary fields, the encrypted store for sensitive ones.

In the contact detail sheet, the Custom Fields tab (at /contacts?contact=<id>) shows each sensitive field as a lock icon next to its name, with no value in line. If the contact has a value on file, a Reveal button appears; if the field is empty, the row shows a dash and no button.

Revealing a value

Click Reveal to decrypt the value on the server and display it in monospace text next to a Hide button. The revealed value lives only in that on-screen component — it is not written into the page payload — so clicking Hide clears it from view, and reloading the page hides it again.

Reveal is gated on the pii.view permission. This permission is not implied by being an owner or admin — it has to be granted explicitly to each member in accounts.mercleo.com. Without it, the click returns "You don't have permission to view sensitive fields." and the value stays hidden.

Every reveal is logged

A successful reveal writes one access-log entry per revealed field. Each entry records the account, the contact, the user who looked, the field key, and the timestamp, giving you a durable "who saw which sensitive field, when" trail. This read-audit is kept separate from the contact's History tab, which records writes; access entries persist even after a contact is deleted.

Edits to a sensitive field are still tracked in the History tab, but the recorded value is redacted — the log shows that a change occurred without storing the plaintext. The actual value only ever appears through the gated reveal path.

Things to know

• Turning off Sensitive (PII) on a field that already has values does not move existing data — a value moves between the encrypted and plaintext stores only on its next write. To bring older values into plaintext, re-enter them after changing the flag.
• Sensitive values are not included in the contacts CSV export, and they cannot be revealed in bulk. To read one, open the contact and reveal the field individually.
• When no custom fields are defined for the account, the Custom Fields tab shows "No custom fields defined for this account. Add fields in Reach → Settings → Custom Fields."