Skip to main content

Step 2: Encrypt Customer PII Data

The pattern you used to encrypt credit card numbers can be applied to any piece of Personally Identifiable Information (PII). In this step, you will extend your pipeline to also encrypt the ssn and email fields.

The Goal​

You will enhance your existing processor to also:

  1. Encrypt the ssn and email fields.
  2. Extract ssn_last_four and email_domain for analytics.
  3. Delete the original ssn and email fields.

Implementation​

  1. Start with the Previous Pipeline: Copy the encrypt-card.yaml file from Step 1 to a new file named encrypt-pii.yaml.

    cp encrypt-card.yaml encrypt-pii.yaml

  2. Inspect the maintained mapping: Review the selected fields, key lookup, and plaintext removal in the linked reference before adapting the processor.

    See the complete configuration for the maintained encryption mapping and its ciphertext fields.

    Note: Use the key variable names from the configuration you are adapting.

  3. Deploy and Test:

    # Send the sample payment data, which includes a customer object
    curl -X POST http://localhost:8080/events/payment \
      -H "Content-Type: application/json" \
      -d @/tmp/encryption-test/sample-payment.json

  4. Verify: Check your logs. You will see that in addition to the encrypted card number, the customer object now contains ssn_encrypted, ssn_last_four, email_encrypted, and email_domain, while the original ssn and email fields have been removed.

The existing processor now handles the additional PII fields. You can repeat this pattern for other sensitive fields.