Response Redaction removes personal information, such as names, email addresses, and phone numbers, from the written responses that visitors submit to your guides and surveys. You choose which types of information Pendo removes for each application.
Overview
Visitors sometimes include personal information when they answer open-text questions in guides and surveys. Response Redaction detects this information and removes it before the response is stored, so it doesn't appear in your response data.
Redaction settings apply to one application at a time. Applications in the same subscription can use different settings.
Response Redaction is separate from redaction in Agent Analytics. It doesn't change what's redacted from AI agent prompts and conversations. For information about redaction in Agent Analytics, see Data collection and security for Agent Analytics.
How redaction works
Response Redaction applies to written responses to guides and surveys. It doesn't apply to other written content in Pendo, such as Listen feedback, Ideas portal submissions, or Agent Analytics data. Numeric ratings, such as NPS scores, and selected answer options aren't redacted.
Pendo makes its best effort to remove the types of information you select from written responses. Redaction uses a self-hosted machine learning model that runs on Pendo infrastructure.
Where redacted text appears in Pendo, the original text is replaced with a labeled placeholder that names the type of information detected, such as [EMAIL_1].
Because redaction happens before the response is stored, responses sent to Listen or exported through Data Sync also contain the redacted text.
What you can redact
You can select any combination of the following categories.
| Category | What it covers |
| Names | First and last names. |
| User names | Usernames and account handles. |
| Email addresses. | |
| Phone number | Phone and fax numbers. |
| Physical address | Street addresses, cities, states, postal codes, and countries. |
| Dates | All dates, including dates of birth and employment dates. |
| SSN | US Social Security numbers. |
| National ID | National ID numbers, such as passports and National Insurance numbers. |
| Tax ID | Tax IDs, such as EIN and TIN. |
| Credit/debit card | Card numbers and security codes. |
| Bank account info | Account numbers, routing numbers, and SWIFT or BIC codes. |
| Invoices | Invoice, payment, and reimbursement reference numbers. |
| Currency amounts | Salaries, wages, bonuses, commissions, and payment amounts that include a currency symbol. |
| IP addresses | IPv4 and IPv6 addresses. |
Prerequisites
- You must be a subscription admin to change these settings.
- Response Redaction is available for web applications.
Turn on Response Redaction
Response Redaction is off by default for all applications.
- Navigate to Settings > Subscription settings.
- Open the Applications tab and select the application you want to configure.
- Open the Response Redaction tab.
- Turn on Redact responses.
- Under What do you want to redact?, select the categories of information you want to remove from responses.
- (Optional) Select View redacted preview and enter sample text to see how your selected categories apply to it.
- Select Save changes.
Change or turn off Response Redaction
- Navigate to Settings > Subscription settings.
- Open the Applications tab and select the application.
- Open the Response Redaction tab.
- Do one of the following:
- To change what's redacted, select or clear categories under What do you want to redact?.
- To stop redacting responses, turn off Redact responses.
- Select Save changes.
When changes take effect
Changes apply to future guide and survey responses. Responses that Pendo already collected keep the redaction that was in place when they were submitted. Clearing a category doesn't recover data that was already redacted, and selecting a new category doesn't redact responses that were already collected.
Limitations of redaction
Redaction is a best-effort process. Detection is probabilistic, so sensitive data can be missed, particularly when it appears in an unusual format.
We recommend writing guide and survey questions that discourage visitors from entering sensitive or confidential information. Because redaction can't detect every possible format, it's your responsibility to design your guides and surveys to prevent sensitive data collection whenever possible.