PII Detection

[kyle-ssg]

Segment has quite a nice feature where it detects attempts at setting PII traits

This seems quite relevant to flagsmith traits and potentially a useful tool for larger data sensitive organisations.

How it could work:

• In the admin panel at the organisation or project level, allow admins to define PII matchers.
• We could also just let admins define a list of traits that are allowed, this is very rigid but could potentially be opt in ?
• I think ideally this is validated at the SDK level, that way traits are never sent across the wire. With fuzzy matching this might be quite difficult to maintain/impossible?
• For each of these traits we can configure whether they are transient

[dabeeeenster]

I don't think this should be the responsibility of the SDK in any way tbh. Matching on a greylist and then alerting relevant Flagsmith admins is probably the way? Then having a default list that we start with would be a nice feature.

I don't think I've ever heard anyone ask for a whitelist of trait keys?

[kyle-ssg]

People have definitely been concerned about traits and saying they'll have to be very careful using them if at all. I do think this pushes the theme of data sensitivity. The latest example is where a company has a governance team and wants to make sure all the projects are using Flagsmith appropriately.

The only reason I thought SDK is because it'd catch it the earliest, I guess if it's alerted on first request that's about as good.