#northwind-billing
Dana
Renewal floor is agreed with their finance lead. Questions, call me on 555-0142 or email dana@northwind.example.test.
Picked up from a shared channel
Product/Sensitive-data protection
Personal data is caught on the way in,and masked before it is stored.
Emails, phone numbers and ID numbers are detected as content arrives. Each workspace chooses what happens next: mask it, hold it for a person or keep it out entirely.
Free tier, no card required.
#northwind-billing Sensitive-data check
Phone numberchecking
Email addresschecking
ID numberchecking
Card numberchecking
Northwind policy: mask emails and phones
Stored as a memory
Northwind / Client comms
Renewal floor agreed by Dana·Slack threadHuman
Dana·Slack threadHuman Questions, call Dana on 555-0142[phone] or email dana@northwind…[email].
audience: account teamsensitivity: confidential2 items masked
Policy event logged · 14:02
The original numbers never reach the memory, so no agent can recall themIllustrative product animation
You decide what happens,one kind of data at a time.
The same incoming note can be masked, held for a person, kept out entirely or stored with a tag. Pick an action to see what lands in memory.
Contractor access request by 
Claude Code·coding sessionAI
Claude Code·coding sessionAI Kestrel asked for staging access for their contractor, staff ID KS-448210, contact sam@kestrel.example.test.
found: 1 ID number1 email
Stored, maskedContractor access request
Kestrel asked for staging access for their contractor, staff ID [ID], contact [email].
recallable: yesoriginals kept: no
The memory is useful straight away, and the numbers themselves were never stored.
In reviewWaiting for a person
Stored in the review queue for Kestrel. No agent can recall it until someone on the account team approves or rejects it.
Priya is asked to reviewUseful for sources where a person should look before anything becomes context.
Not storedKept out of memory
Nothing saved from this item.
Policy event logged · 14:09
Policy event logged · 14:09
For data that should never be in an agent's reach, such as card numbers.
Stored, taggedContractor access request
Stored as written, with a tag that says it holds personal data, so it is easy to find, review or relabel later.
tag: personal datasensitivity: confidential
For workspaces that need the detail, with a clear marker on every item that carries it.
One data policy per workspace,with the organization's rules on top.
Each workspace sets its own rules. Rules set by your organization apply everywhere and can be locked, so no single workspace can switch them off. Every trigger is written to a log.
When new content containsapplies to every source and agent
Email addressesthis workspaceMask
Phone numbersthis workspaceAllowMask
ID numbersthis workspaceHold for review
Card and bank account numbersset by your organizationBlock
Mentions of "contract" or "MSA"raise sensitivityConfidential
Public visibilityset by your organizationNot allowed
Saved by Dana. The change is in the audit log.Policy eventsNorthwind
Workspace rules plus locked organization rulesIllustrative product animation
Sensitivity labels decidehow far a memory travels.
Every memory carries one of four labels. Collections set a default, policies can raise it, and each agent key is granted the labels it may read. Confidential and restricted need an explicit grant.
- Contracts can start out confidential through their collection
- A customer-facing assistant can be kept to public and internal
- Label changes are recorded with who made them
Publicsafe to share
Internalyour team
Confidentialnamed groups
Restrictedthe fewest people
What each key may readExample data
Claude Code
CursorSupport assistant
Built to catch the common cases,and clear about the rest.
Detection runs on every item, whichever door it came through. Here is how to get the most from it.
Formats it knows
Emails, phone numbers, ID numbers, and card and bank account numbers in their usual formats. Unusual formats can slip past, so pair sensitive sources with review.
Review for the risky sources
For an HR folder or a support inbox, hold new items for a person. Nothing in the queue can be recalled until it is approved.
Everything is on the record
Every mask, hold and block is a policy event you can look up later, with the source, the workspace and the time.
Questions
Email addresses, phone numbers, ID numbers such as social security numbers, card numbers and bank account numbers. Detection runs on content from connectors, uploads, the API and agents alike.
Yes, when the workspace policy says to mask it. The memory is saved with the masked version, so no agent or person can recall the original from MeshTale.
Workspace admins set the policy for their workspace. Organization admins can add rules that apply to every workspace and lock them, so a workspace cannot switch them off.
Yes. Each workspace, usually one per client, has its own policy and restrictions. One client can mask phone numbers while another holds everything with an ID number for review.
No. It is a strong default for keeping personal data out of agents' reach, and every action is logged. Your own obligations, and what you connect in the first place, are still yours to decide.
Give agents the context,keep the phone numbers out.
Set a data policy for your first workspace and connect a source.
Free tier, no card required.