De-identification strips what detection names, and detection used to sniff the first 200 rows of each column for email-shaped values, flagging a column only when more than 30 percent of the sample matched. Three ordinary file shapes slipped past it: a sorted export whose addresses begin after row 200, a sheet appended to an older one, and a column blank for its first rows. A hundred addresses in a hundred-thousand-row file is a 0.1 percent rate and a real leak.
The sniff now reads every row of every text column, over the frame the import
already holds, with no second parse. One match is enough: a single raw
identifier at rest is the thing the policy forbids. Separator-bearing phone
numbers, +-prefixed international numbers and hyphenated SSNs count
alongside email addresses; a bare run of digits never matches, so record ids,
amounts and timestamps stay as they are.
One cost, stated plainly: a free-text column holding one embedded address is now flagged and dropped, and a presence flag for the column is kept in its place.