A court security team strips SSNs from tickets before enrichment calls leave the network. What enrichment safeguard is that?

A court security team that strips SSNs from tickets before enrichment calls leave the network is practicing privacy-preserving enrichment. Outbound intel and reputation APIs do not need national identifiers to return useful context on hosts, URLs, or hashes. Redacting SSNs at the enrichment boundary prevents unnecessary disclosure of sensitive judicial case data to third parties while still allowing civic SOC tooling to enrich technical indicators. Why the other options fail by concept: Encrypting SSNs before outbound enrichment calls still places reversible ciphertext in the outbound payload rather than removing identifiers, so it fails to strip SSNs the way redacting before calls leave the network does. Tokenizing SSNs before outbound enrichment calls substitutes reversible tokens that preserve linkability and depend on a token vault, so it fails to fully strip identifiers the way redacting before calls leave the network does. Hashing SSNs before outbound enrichment calls still sends deterministic hashes of low-entropy SSN values that can be brute-forced to recover the originals, so it fails to remove identifiers the way redacting before calls leave the network does. Exam caveat: Redaction must cover common SSN formats and adjacent identifiers in free-text ticket fields; partial scrubbing that leaves SSNs in attachments still fails the privacy goal. Operational check: submit a synthetic ticket containing an SSN in description and attachment metadata, run outbound enrichment, and inspect egress payloads to confirm the SSN is absent while technical indicators remain enrichable.