The Shadow Sentinel
A decontamination airlock between your users' identity and everyone who wants it.
The incident
Marketing wanted conversion attribution, so the pixel got the signup event — with the raw email in the payload. Eighteen months later a privacy audit asked one question: 'list every third party holding user PII and your lawful basis for each.' The honest answer was a very expensive surprise.
Why the obvious approach fails
PII leaks are rarely a hack — they're a default. Analytics SDKs serialize whatever object they're handed; log statements capture whole request bodies; error trackers snapshot state. Each individual leak looks harmless and reversible. Collectively they put regulated data (GDPR, HIPAA, CCPA) into systems with different retention, different jurisdictions, and no deletion path. Trusting every developer to sanitize every call site fails statistically. Egress is a chokepoint problem: sanitize at the gateway, where policy can be enforced once.
The standard
- All outbound events to third parties pass through an egress interceptor — direct SDK calls with user objects are banned.
- Identifier fields (email, phone, user ID) are auto-detected and one-way hashed (salted SHA-256) before leaving the server; attribution still works, identity doesn't travel.
- Egress policies are explicit data: which fields may go to which destination — "credit_score never leaves" is a rule, not a hope.
- PHI never enters logs, analytics stores, or LLM context windows; those paths carry redaction by construction.
- The third-party data map is generated from the policies, so the audit answer is a report, not an archaeology project.
How Cortex validates it
At plan time
The blueprint declares data classifications and egress destinations; any third-party integration without an egress policy fails plan review.
At validation
assert: outbound_payloads.pii_fields == hashedassert: sdk_direct_calls == 0assert: log_samples.contains_pii == falseAssertion syntax is illustrative.
At review
The approver sees captured egress traffic from the test run: every payload, every destination, zero raw identifiers.