Snapshotting PII

When a request hits Completed, the recipient’s name + contact get redacted in the active view and a snapshot is stored encrypted in the audit log. This is intentional: it limits ongoing PII exposure without losing the historical record.

Who this is for: anyone reviewing completed requests + compliance reviewers.

What’s preserved

Encrypted at-rest via CARTONCREW_PII_KEY (AES-256-GCM):
- Recipient name (snapshot at completion time)
- Requester name + contact (snapshot)
In plain text in the active view:
- Request status, dates, shipping method, request notes (no recipient identity)
- Audit log entries (who did what when, but not the recipient name)

What’s redacted

After completion the request row shows:

Recipient name → “(redacted)”
Requester contact → “(redacted)” except for the consented-marketing-tier subset.

If you need to recover the snapshot (e.g. for a follow-up the next year), an Owner with the Reveal PII capability can click Reveal snapshot on the row and the audit log captures who + when.

Why

Limits the surface area if a CartonCrew account is compromised.
Honors the implicit consent model: a requester didn’t sign up for permanent surveillance, only for the help they asked for.
Keeps the historical audit defensible (records weren’t deleted; just access-gated).

What you’ll see

Video — coming soonSnapshot a recipient name on completionRecorder brief: V24 — Mark request complete, show recipient row flips to (redacted), click Reveal snapshot as Owner, show audit log row created.

Common issues

“Reveal snapshot” button missing — your role doesn’t have the requests.reveal_pii capability. Ask an Owner.
Need to delete the snapshot for a “right to be forgotten” request — Owner → Settings → Data → Delete requester with the requester id. Audit-logged; irreversible.

Last updated: 2026-06-01 · Applies to: CartonCrew v1.56+