A housing bot stores Claude transcripts in logs. Which privacy control fits?

Redacting SSN and DOB before logs store Claude transcripts is the privacy control housing bots need when conversations touch identity. That practice works because logs are broadly accessed for debugging and analytics; storing raw SSN and DOB creates durable exposure far beyond the chat turn. Redaction keeps operational troubleshooting possible while meeting municipal privacy expectations for eligibility conversations.

Encrypting log delivery with TLS while keeping identifiers in storage fails because TLS only protects data in transit; once the logs are written, the full SSN and DOB remain readable in storage, so the exposure the control is meant to prevent never goes away. Hashing identity data using one-way encryption instead of removing it fails because SSNs and birth dates have so little entropy that a hash can be brute-forced or matched against a precomputed table, so a hashed field in the log is still an identity leak, just a disguised one, rather than the redaction the control calls for. Restricting log access by role while retaining full identifiers fails because the SSNs and DOBs are still sitting in the logs; role limits do not remove the identity data, so any authorized viewer or later breach still exposes regulated housing information.

Exam caveat: redaction must cover variants and adjacent fields (partial SSN, "date of birth" spelled out); incomplete patterns create a false sense of safety. Operational check: apply redaction at log-write time for SSN/DOB patterns, verify with canary chats that raw values never land in log stores, restrict log access, and include housing transcript privacy in the city's periodic access review.