PII Detection in Support Tickets

Why Support Tickets Fill Up With PII You Never Asked For

Support is the one channel where customers are actively trying to hand you sensitive data. A user who wants a refund pastes the full card number "to make it faster". A patient disputing an invoice describes their diagnosis. Someone locked out of their account sends a photo of their passport — unprompted — because it worked with their bank. Unlike a checkout form, which collects exactly the fields it is designed to collect, a ticket is a free-text box connected directly to a customer's sense of urgency. Over-sharing is the norm, not the exception.

The result is that helpdesks quietly become one of the largest unmanaged PII stores in the company. Ticket bodies, comment threads, chat transcripts, satisfaction-survey verbatims, and attachments accumulate for years, indexed and searchable by every agent, team lead, and — via analytics exports and BI connectors — by teams far outside support. Agents also copy ticket content outward: into Slack threads when they escalate, into Jira when they file bugs, into macros and knowledge-base drafts. Every copy inherits the pasted card number.

The exposure is broader than most audits assume. Helpdesk data routinely flows to sub-processors (translation services, AI summarizers, QA scoring tools), to offshore BPO partners with wide read access, and into training corpora for support chatbots. A single ticket containing a name, address, and payment card can therefore surface in half a dozen systems, none of which appear in the data map as "stores cardholder data". PCI DSS assessors increasingly ask about helpdesks for exactly this reason, and GDPR's data-minimization principle applies to a Zendesk instance just as it does to a database.

The fix is not telling customers to stop over-sharing — they won't — but detecting sensitive data the moment it arrives and masking it before it spreads. Because the PII Detection API returns typed entities with offsets, confidence scores, and a ready-masked version of the text, the entire workflow — scan on ticket creation, redact in place, tag for audit — fits in a small webhook handler, which this guide builds step by step. You can preview detection behavior on a sample ticket right now in the live demo.

Webhook-Based Ticket Scanning, End to End

Start with the raw detection call your webhook will make. A typical over-sharing ticket looks like this — note the mixture of legitimate workflow data and never-store data:

# Scan a new ticket body for high-risk entities
curl -X POST https://piidetectionapi.com/api/moderate.php \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "YOUR_API_KEY",
    "api_type": "pii_detection",
    "text": "Please refund my order. Card: 4111 1111 1111 1234, exp 04/27, CVV 812. Im Anna Schmidt, Hauptstrasse 12, Berlin. You can also reach me at +49 170 555 0117.",
    "entities": ["CREDIT_CARD_NUMBER", "CREDIT_CARD_EXPIRATION_DATE", "CVV_NUMBER",
                 "SSN", "NATIONAL_ID", "PASSPORT_NUMBER", "PASSWORD", "IBAN_CODE",
                 "PERSON_NAME", "ADDRESS", "PHONE_NUMBER"],
    "mask_mode": "replace",
    "threshold": 0.6,
    "custom_instruction": "Do not flag order numbers or ticket reference codes."
  }'

The response identifies each entity with offsets and confidence, and anonymized_text arrives ready to write back. The Node.js handler below is a complete Zendesk-style webhook receiver: it scans the comment, redacts via the helpdesk API only when high-risk types appear, and tags the ticket for auditability. The same skeleton serves Intercom and Freshdesk with different write-back URLs:

// Express webhook: scan new comments, redact high-risk PII, tag ticket
const HIGH_RISK = ["CREDIT_CARD_NUMBER", "CVV_NUMBER", "SSN",
                   "NATIONAL_ID", "PASSPORT_NUMBER", "PASSWORD", "IBAN_CODE"];

app.post("/hooks/ticket-comment", async (req, res) => {
  res.sendStatus(200);                          // ack fast; work async
  const { ticket_id, comment_id, body } = req.body;

  const scan = await fetch("https://piidetectionapi.com/api/moderate.php", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
      api_key: process.env.PII_API_KEY,
      api_type: "pii_detection",
      text: body,
      entities: [...HIGH_RISK, "PERSON_NAME", "ADDRESS", "PHONE_NUMBER"],
      mask_mode: "replace",
      threshold: 0.6
    })
  }).then(r => r.json());

  const risky = scan.detected_entities
    .filter(e => HIGH_RISK.includes(e.type) && e.confidence >= 0.8);
  if (!risky.length) return;

  // 1) Replace the comment with the masked rendering
  await zendesk.put(
    `/api/v2/tickets/${ticket_id}/comments/${comment_id}/redact`,
    { text: scan.anonymized_text });

  // 2) Tag + audit trail (types and counts only — never raw values)
  await zendesk.put(`/api/v2/tickets/${ticket_id}`, {
    ticket: { additional_tags: ["pii_redacted"],
              comment: { public: false,
                body: `Auto-redacted: ${risky.map(e => e.type).join(", ")}` } }
  });
});

Two operational details matter. Acknowledge the webhook immediately and do the scan-and-redact asynchronously — helpdesks retry slow webhooks and you do not want duplicate redactions. And make the handler idempotent: record scanned comment IDs so a redelivered event is a no-op rather than a second private note.

Analytics on Scrubbed Tickets: Keep the Signal, Drop the Identity

The historical objection to redacting tickets was "we need the data for analytics". It turns out almost nothing support analytics needs is the PII itself. Topic modeling, CSAT driver analysis, deflection measurement, agent QA, escalation prediction — all operate on what the ticket is about, not who the customer is. Masked text with typed placeholders preserves the aboutness completely: "[NAME] cannot log in after the [DATE] release" clusters exactly as well as the raw sentence, and arguably better, since names and numbers are noise to a topic model anyway.

A scrubbing pass therefore belongs at the boundary between the helpdesk and every downstream consumer: the nightly export to the warehouse, the BI connector, the training-set builder for your support LLM, the sample sets sent to QA vendors. Feed them anonymized_text plus the entity metadata, and three new analytics become possible that raw data never offered: PII inflow rate (which channels and forms cause customers to over-share — a web form with a free-text box next to a payment page will light up), agent hygiene (which teams paste sensitive data into escalations), and compliance posture (tickets containing card data per week, trending to zero as your prevention improves).

Where identity-level analysis is legitimately needed — churn-risk joins, lifetime-value segmentation — hash mode provides pseudonymous keys that join across tickets and even across systems without exposing the underlying identity to the analyst. Access to the mapping stays with the small team that operates the vault. This layered design typically satisfies both the analytics team and the DPO, a combination rarely achieved with raw exports; the regulatory reasoning is laid out in the GDPR PII detection guide.