Skip to content
ZK
ZAIN KHALIL KHAN
PORTFOLIO
All projects

Interactive build

Data Classifier | PII, PHI & PCI Detection

Sensitive data classifier that pairs each detector with a checksum or a context anchor (Luhn validation for card numbers, label anchoring for record numbers and dates of birth), derives a document classification from the strongest category found, and renders an in-place redacted view.

Live demo readyData Classification + PII
Data ClassificationPIIPHIPCI DSSRedactionPrivacy EngineeringCase study / interactive demo

Case study

From problem to working system

Problem

Sensitive data classifier that pairs each detector with a checksum or a context anchor (Luhn validation for card numbers, label anchoring for record numbers and dates of birth), derives a document classification from the strongest category found, and renders an in-place redacted view.

My role

Full-stack software engineer

Solution

Sensitive data classifier that pairs each detector with a checksum or a context anchor (Luhn validation for card numbers, label anchoring for record numbers and dates of birth), derives a document classification from the strongest category found, and renders an in-place redacted view.

Architecture

The implementation combines the following technologies and system concerns.

Data ClassificationPIIPHIPCI DSSRedactionPrivacy Engineering

How it was built

  • Validated payment card candidates with the Luhn algorithm, so a 16-digit order reference is not reported as cardholder data.
  • Excluded the Social Security number ranges that were never issued, which removes most of the false positives a naive pattern produces.
  • Anchored medical record numbers and dates of birth on their labels rather than matching any similarly shaped number.
  • Derived the document classification from the strongest category detected, so labelling follows content instead of being set by hand.

Security decisions

  • Validated payment card candidates with the Luhn algorithm, so a 16-digit order reference is not reported as cardholder data.
  • Excluded the Social Security number ranges that were never issued, which removes most of the false positives a naive pattern produces.

Major challenges

  • Validated payment card candidates with the Luhn algorithm, so a 16-digit order reference is not reported as cardholder data.
  • Excluded the Social Security number ranges that were never issued, which removes most of the false positives a naive pattern produces.
  • Anchored medical record numbers and dates of birth on their labels rather than matching any similarly shaped number.

Verified evidence

Results and measurable impact

  • Anchored medical record numbers and dates of birth on their labels rather than matching any similarly shaped number.
  • Derived the document classification from the strongest category detected, so labelling follows content instead of being set by hand.
  • Rendered redaction in place with the category substituted, preserving document structure for downstream systems that must not hold the identifier.
  • Reported rejected candidates explicitly, because showing what the classifier declined to flag is what earns trust in what it did flag.

No separate numeric outcome is documented, so this section shows shipped technical evidence without inventing metrics.

Screenshots and access

Product view

Open live project

Interactive Demo

A scoped, fully functional recreation of this project's core feature runs below, live in your browser. Reset it, resize it, or expand it to full screen.

Data Classifier

Product workspace

Data ClassifierWorkspace3 updates
Data Classifier · Detection & Redactionclassified restricted (pci)
5 identifiers

Pattern matching alone over-reports: a 16-digit order reference is not a card number and every date is not a birth date. Each detector here pairs a pattern with either a checksum or a context anchor, and the document's classification is derived from the strongest category found rather than set by hand.

Identifiers

5

PCI, PII

Classification

Restricted

Restricted (PCI)

Rejected matches

0

failed checksum validation

Detectors run

7

PII, PHI, and PCI

SensitivityRestricted (PCI)
5restricted
Redacted document
Customer called about a declined payment. Card on file [PCI:PAN] exp 04/29.
Contact: [PII:EMAIL], mobile [PII:PHONE].
Verified identity with SSN [PII:SSN] and [PII:DOB].
Order reference ORD-99183, invoice total 412.00 USD.
Detections
Payment card number41•••••••••••••••11PCI

Luhn-validated, so a random 16-digit reference is not reported as a card.

US Social Security number21•••••••31PII

Excludes the ranges the SSA never issues, which is what removes most false positives.

Email addressda••••••••••••••••••omPII

Standard address form.

Phone number31••••••••48PII

North American format with separators.

Date of birthDO••••••••••14PII

Anchored on a DOB label so ordinary dates are not classified as identifiers.

Redaction replaces the value in place with its category, so downstream systems keep the document structure without holding the identifier.

Zain Khalil Khan