npm - n8n-nodes-redactor - Versions diffs - 1.11.0 → 1.11.1 - Mend

n8n-nodes-redactor 1.11.0 → 1.11.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2) hide show

package/README.md +113 -376
package/package.json +1 -1

package/README.md CHANGED Viewed

@@ -5,417 +5,154 @@
 <h1 align="center">n8n-nodes-redactor</h1>
 <p align="center">
-  <strong>Stop sending your customer data to OpenAI, Claude, and Gemini unprotected.</strong><br/>
-  Built, maintained, and owned by <a href="https://next8n.com">next8n</a>
+  <strong>Keep personal data out of OpenAI, Claude and Gemini while your n8n AI workflows keep working.</strong><br/>
+  Built and maintained by <a href="https://next8n.com">next8n</a>
 </p>
 <p align="center">
-  <a href="https://www.npmjs.com/package/n8n-nodes-redactor"><img src="https://img.shields.io/npm/v/n8n-nodes-redactor?style=for-the-badge&color=CB3837&label=npm" alt="npm version" /></a>
-  <a href="https://www.npmjs.com/package/n8n-nodes-redactor"><img src="https://img.shields.io/npm/dt/n8n-nodes-redactor?style=for-the-badge&color=blue&label=downloads" alt="npm downloads" /></a>
-  <a href="#license"><img src="https://img.shields.io/badge/license-MIT-blue?style=for-the-badge" alt="MIT License" /></a>
-  <a href="https://docs.npmjs.com/generating-provenance-statements"><img src="https://img.shields.io/badge/npm-Provenance_Signed-2ea44f?style=for-the-badge" alt="npm provenance" /></a>
-  <img src="https://img.shields.io/badge/PII_Patterns-216-success?style=for-the-badge" alt="216 PII patterns" />
-  <img src="https://img.shields.io/badge/Tests-437_Passed-brightgreen?style=for-the-badge" alt="437 tests passed" />
-  <img src="https://img.shields.io/badge/Categories-11-success?style=for-the-badge" alt="11 categories" />
-  <img src="https://img.shields.io/badge/Operations-7-success?style=for-the-badge" alt="7 operations" />
-  <img src="https://img.shields.io/badge/n8n-2.x_Ready-FF6D5A?style=for-the-badge" alt="Tested on n8n 2.x" />
-  <img src="https://img.shields.io/badge/Vault-AES--256--GCM_Encrypted-7B61FF?style=for-the-badge" alt="AES-256-GCM Vault" />
-  <img src="https://img.shields.io/badge/Presidio-NLP_Optional-7B61FF?style=for-the-badge" alt="Presidio NLP" />
-  <img src="https://img.shields.io/badge/Vault-Reversible-7B61FF?style=for-the-badge" alt="Reversible Vault" />
-  <img src="https://img.shields.io/badge/GDPR-Art.30_ROPA_Record-00C4B4?style=for-the-badge" alt="GDPR Art.30 ROPA record" />
-  <img src="https://img.shields.io/badge/100%25-Local_Processing-10A37F?style=for-the-badge" alt="100% Local" />
-  <img src="https://img.shields.io/badge/n8n-Community_Node-FF6D5A?style=for-the-badge" alt="n8n Community Node" />
-  <img src="https://img.shields.io/badge/AI_Agent-Compatible-10A37F?style=for-the-badge" alt="AI Agent Compatible" />
-  <img src="https://img.shields.io/badge/TypeScript-Strict-3178C6?style=for-the-badge&logo=typescript&logoColor=white" alt="TypeScript" />
-  <img src="https://img.shields.io/badge/Maintained-Active-brightgreen?style=for-the-badge" alt="Actively Maintained" />
+  <a href="https://www.npmjs.com/package/n8n-nodes-redactor"><img src="https://img.shields.io/npm/v/n8n-nodes-redactor?label=npm" alt="npm version" /></a>
+  <a href="https://www.npmjs.com/package/n8n-nodes-redactor"><img src="https://img.shields.io/npm/dm/n8n-nodes-redactor?label=downloads" alt="npm downloads" /></a>
+  <a href="https://github.com/mjmirza/n8n-nodes-redactor/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/mjmirza/n8n-nodes-redactor/ci.yml?branch=master&label=CI" alt="CI status" /></a>
+  <a href="https://www.npmjs.com/package/n8n-nodes-redactor#provenance"><img src="https://img.shields.io/badge/npm-provenance%20signed-brightgreen" alt="npm provenance" /></a>
+  <a href="#license"><img src="https://img.shields.io/npm/l/n8n-nodes-redactor" alt="MIT License" /></a>
+  <img src="https://img.shields.io/badge/PII%20patterns-216-blue" alt="216 PII patterns" />
+  <img src="https://img.shields.io/badge/n8n-self--hosted-FF6D5A" alt="Self-hosted n8n" />
 </p>
----
+## What you get
-## Your customer data is leaving your server right now.
+- **Personal data never reaches the model.** Emails, phone numbers, IBANs, card numbers, national IDs and 200 more kinds of data are swapped for safe tokens before the LLM call.
+- **The answer still makes sense.** After the model replies, the node puts the real values back, so your output reads naturally.
+- **Fewer false alarms.** Card numbers are Luhn checked, IBANs checksum verified, NHS numbers mod 11 validated, so random digits are left alone.
+- **Proof for your records.** An optional audit report, and a GDPR Article 30 processing record built from each run.
+- **No new vendor.** Everything runs inside your own n8n. No cloud service, no API key, no runtime dependency.
-Every time your n8n workflow sends a customer email, phone number, address, IBAN, or credit card to OpenAI or Claude - **that data is gone**. You don't control it anymore. Your customer didn't consent to it. And under GDPR, **you're liable**.
+## From install to first result
-You know this is a problem. Your clients know it too. But rebuilding every workflow to strip PII manually? That's weeks of work nobody has time for.
+1. In n8n open **Settings**, then **Community Nodes**, enter `n8n-nodes-redactor` and install.
+2. Add a **Redactor** node before your OpenAI, Claude or Gemini node and set the operation to **Redact**.
+3. Add a second **Redactor** node after the model and set it to **Restore**.
+4. Run the workflow. Both nodes share the execution ID as Session ID, so a full run works with no extra setup. When testing one node at a time, set the same fixed Session ID, for example `test-1`, on both.
-**This node fixes it in 2 minutes.**
+The model receives tokens instead of personal data.
-Drop it between your data source and your LLM node. It automatically detects and replaces 216 kinds of sensitive data with safe tokens. The LLM processes the clean data. Then the node swaps the original values back in. Your customer data never leaves your server.
-No cloud service. No API keys. No third-party dependency. Everything runs locally on your machine.
-<p align="center">
-  <a href="https://services.next8n.com"><img src="https://img.shields.io/badge/Need_Help_Setting_Up%3F-Book_a_Free_Call-FF6D5A?style=for-the-badge&logoColor=white" alt="Book a consultation" /></a>
-</p>
----
-## How it works
-```
-[Your Data] --> [PII Redactor: REDACT] --> [OpenAI / Claude / Gemini] --> [PII Redactor: RESTORE] --> [Clean Output]
-```
-**Before the LLM sees it:**
 ```json
-{
-  "message": "Mrs. Sarah Johnson (sarah@bigcorp.com) reported a billing issue. SSN: 987-65-4321"
-}
+{ "message": "[PERSON_0] ([EMAIL_1]) reported a billing issue. SSN [SSN_2]" }
 ```
-**What the LLM actually receives:**
-```json
-{
-  "message": "[PERSON_0] ([EMAIL_1]) reported a billing issue. SSN: [SSN_2]"
-}
-```
+After Restore, your workflow gets the real values back.
-**After the LLM responds, the node restores everything automatically:**
 ```json
-{
-  "reply": "I've resolved the billing issue for Mrs. Sarah Johnson. A confirmation has been sent to sarah@bigcorp.com."
-}
-```
-The LLM never saw the real data. Your customer never knew the difference.
----
-## What it detects (216 patterns across 11 categories)
-### Contact Information
-| Type | Examples |
-|------|----------|
-| Email | `john@company.com`, `user+tag@sub.domain.co.uk` |
-| Phone | `(555) 123-4567`, `+49 30 1234-5678` |
-| UK Phone | `020 7946 0958`, `+44 7911 123456` |
-| Person Names | `Mr. John Smith`, `Dr. Anna Wilson`, `Frau Weber`, `Señor García` |
-### Financial Data
-| Type | Validation |
-|------|------------|
-| Credit Cards | Luhn algorithm verified - rejects random 16-digit numbers |
-| IBAN | ISO 13616 checksum verified - rejects invalid checksums |
-| BIC/SWIFT | `DEUTDEFF`, `DEUTDEFF500` |
-| EU VAT Numbers | All 27 EU member states covered |
-| UK Bank Accounts | Sort code + account number |
-### Government IDs
-| Type | Coverage |
-|------|----------|
-| US SSN | `123-45-6789` |
-| US/EU Passports | `C12345678`, `AB1234567` |
-| UK NHS Numbers | With mod-11 checksum validation |
-| German National ID | 10-character format |
-| US EIN | `12-3456789` |
-| US Driver License | Common format |
-### Network & Digital
-| Type | Examples |
-|------|----------|
-| IPv4 / IPv6 | `192.168.1.1`, full IPv6 |
-| MAC Addresses | `00:1A:2B:3C:4D:5E` |
-| URLs | Any `http://` or `https://` URL |
-| Bitcoin Addresses | Legacy (`1...`) and Bech32 (`bc1...`) |
-| Ethereum Addresses | `0x742d35Cc...` |
-### Location & Dates
-| Type | Examples |
-|------|----------|
-| US ZIP Codes | `90210`, `90210-1234` |
-| UK Postcodes | `SW1A 1AA`, `EC1A1BB` |
-| GPS Coordinates | `51.5074, -0.1278` |
-| Dates | `15/03/1990`, `2024-03-15`, `15.03.1990` |
-| Dates of Birth | `DOB: 15/03/1990` |
-### Medical & Compliance
-| Type | Examples |
-|------|----------|
-| Medical Record Numbers | `MRN: 12345678`, `MRN#987654` |
-### Government IDs (25+ countries)
-| Country | Types |
-|---------|-------|
-| USA | SSN, ITIN, EIN, Driver License (contextual), Passport |
-| Canada | SIN (Luhn validated) |
-| UK | NINO, NHS (mod-11 checksum), Passport |
-| Germany | Personalausweis, Steuer-ID, Sozialversicherungsnummer, Reisepass, Handelsregister (HRB) |
-| Austria | Sozialversicherungsnummer (date validated) |
-| Switzerland | AHV/AVS number |
-| France | NIR (social security) |
-| Italy | Codice Fiscale, Carta d'Identita |
-| Spain | DNI, NIE, NIF |
-| Netherlands | BSN (11-check validated) |
-| Belgium | Rijksregisternummer |
-| Poland | PESEL (checksum validated) |
-| Sweden | Personnummer |
-| Norway | Fodselsnummer |
-| Denmark | CPR-nummer |
-| Finland | Henkilotunnus (HETU) |
-| Portugal | NIF (checksum validated) |
-| Ireland | PPS Number |
-| Australia | TFN (checksum validated), Medicare |
-| New Zealand | IRD Number |
-| Japan | My Number |
-| South Korea | RRN |
-| Singapore | NRIC/FIN |
-| India | Aadhaar, PAN |
-| Brazil | CPF |
-### Enterprise and Infrastructure
-| Type | Examples |
-|------|----------|
-| Internal Hostnames | `server-web-01.internal`, `db-prod.corp.local`, `nas.lan` |
-| Windows UNC Paths | `\\fileserver\shared\docs` |
-| LDAP Distinguished Names | `CN=John,OU=Users,DC=corp,DC=local` |
-| Active Directory Users | `CORP\jsmith` |
-| Private IPs (RFC 1918) | `10.0.1.50`, `172.16.0.1`, `192.168.1.1` |
-| Database Connection Strings | JDBC, MongoDB, PostgreSQL, MySQL, Redis, MSSQL |
-| API Keys | AWS (`AKIA...`), GCP (`AIza...`), Stripe, OpenAI, GitHub, Slack |
-| Auth Tokens | Bearer tokens, JWT tokens |
-| Cryptographic Material | PEM private keys, SSH public keys |
-| Secrets in Config | `password=`, `api_key=`, `secret=`, `token=` patterns |
-| Azure Keys | Storage keys, SAS tokens |
-| Slack Webhooks | `hooks.slack.com/services/...` |
-### Vehicle
-| Type | Examples |
-|------|----------|
-| VIN | `1HGBH41JXMN109186` (17-character) |
-| License Plates | German (`M AB 1234`), UK (`AB12 CDE`), French (`AB-123-CD`) |
-### Biometric and Digital Identity
-| Type | Examples |
-|------|----------|
-| UUID/GUID | `550e8400-e29b-41d4-a716-446655440000` |
-| Social Media Handles | `@username` |
-| IMEI | Device identifiers |
-| ICCID | SIM card numbers |
-### Custom Business Identifiers
-Add your own patterns for anything specific to your business:
-| Example | Regex |
-|---------|-------|
-| Order IDs | `ORD-\d{6}` |
-| SKU Codes | `SKU-[A-Z0-9]{8}` |
-| Ticket Numbers | `TICKET-\d+` |
----
-## 7 Operations: When to use what
-| Operation | When to use it | What it does | Example workflow |
-|-----------|---------------|-------------|-----------------|
-| **Redact** | Before sending data to an LLM, API, or third-party service | Detects and replaces all sensitive data with safe tokens. Stores originals in vault for later restoration. Also includes prompt injection detection. | `[Data Source] > Redact > [OpenAI] > Restore > [Output]` |
-| **Restore** | After the LLM or service has processed the tokenized data | Swaps all tokens back to original values using the vault. Your output has real data again. | Place after your LLM node, before the final output. |
-| **Detect** | Compliance audits, data assessment, before deciding to redact | Scans all data for sensitive information and returns a full report. Does NOT modify the data. Use this to understand what PII exists. | `[Data Source] > Detect > [If PII found] > Redact` |
-| **Verify** | After redaction, to confirm nothing leaked through | Re-scans redacted output to check if any PII slipped past. Returns PASS or FAIL with details of any leaks. Defense-in-depth. | `[Data Source] > Redact > [LLM] > Verify > [Alert if FAIL]` |
-| **Classify** | Data governance, sensitivity labeling, routing decisions | Assigns sensitivity labels (PUBLIC / INTERNAL / CONFIDENTIAL / RESTRICTED) based on what PII categories are found. Includes escalation rules. | `[Data Source] > Classify > [If RESTRICTED] > Block` |
-| **Purge** | GDPR right to erasure, cleanup, end of workflow | Deletes vault sessions from memory or disk, so no PII mapping is left behind. Supports GDPR Article 17 (right to erasure) requests. | `[End of workflow] > Purge` |
-| **Stats** | Debugging, monitoring, admin | Shows all active vault sessions with entry counts, creation times, TTL, and vault storage type. | Run manually to inspect vault state. |
-**ROPA record (a Redact option, not a separate operation):** turn on *Include Audit Report*, then *Include GDPR Art.30 ROPA Record*, and fill in the controller details. The report output then carries a Records of Processing Activities entry built from this run.
-**Recommended workflow for production:**
-```
-[Data Source] > Detect (assess) > Redact (protect) > [LLM] > Verify (confirm) > Restore (recover) > [Output] > Purge (cleanup)
+{ "reply": "I resolved the billing issue for Mrs. Sarah Johnson and sent a confirmation to sarah@bigcorp.com." }
 ```
----
-## 7 Redaction Modes
-Choose the right mode for your use case:
-| Mode | Output | Reversible? | Best for |
-|------|--------|-------------|----------|
-| **Token** | `[EMAIL_0]` | Yes | LLM workflows (recommended) |
-| **Mask** | `j***@e***.com` | No | Logs, dashboards, support tickets |
-| **Hash** | `[EMAIL:a3f2b8c91d4e]` | No | Analytics, deduplication |
-| **Redact** | `[REDACTED]` | No | Maximum privacy, audit trails |
-| **Pseudonymize** | `sarah.miller@example.com` | Yes | GDPR pseudonymization, demo data, QA environments |
-| **Blackout** | `████████` | No | Visual censoring, document redaction, like a black marker |
-| **Remove** | *(empty string)* | No | Complete deletion, no trace left, total removal |
----
+## Compatibility
-## Smart features that matter
+| Environment | Status |
+|---|---|
+| Self-hosted n8n 1.x and 2.x | Supported |
+| n8n Cloud | Not available |
+| n8n verified community nodes | Not eligible |
-### Deduplication
-When the same email appears in 5 fields, it gets the same token (`[EMAIL_0]`) everywhere. The LLM understands it's the same person. Relationships in your data are preserved.
+The persistent vault, encrypted vault files and JSONL audit log write to the local disk. n8n Cloud and n8n's verification program do not allow community nodes to use the file system, so this node is self-hosted only by design.
-### Field Targeting
-Don't want to scan internal IDs or metadata? Use allowlist or denylist mode:
-- **Allowlist:** Only scan `user.email`, `*.phone`, `contacts[*].name`
-- **Denylist:** Skip `internalId`, `metadata.*`, `debug`
+## Operations
-### Persistent Vault
-Choose between in-memory (fast, lost on restart) or file-based vault (survives n8n restarts). File vault stores mappings in `~/.n8n/pii-vault/`. Sessions auto-expire based on TTL.
+| Operation | Use it when | What it does |
+|---|---|---|
+| Redact | Before an LLM, API or third party | Replaces sensitive values with tokens, stores originals in the vault, and checks the input for prompt injection |
+| Restore | After the model or service replies | Swaps tokens back to the original values |
+| Detect | Assessing data before deciding | Reports what personal data exists without changing anything |
+| Verify | After redaction | Rescans the output and returns PASS or FAIL with any leaked values |
+| Classify | Governance and routing | Labels data PUBLIC, INTERNAL, CONFIDENTIAL or RESTRICTED |
+| Purge | Erasure requests and cleanup | Deletes vault sessions from memory or disk, supporting GDPR Article 17 |
+| Stats | Debugging | Lists active vault sessions with entry counts and TTL |
-### Session TTL
-Vault sessions auto-expire after 60 minutes by default. No unbounded memory growth. Configurable per workflow.
+The recommended production chain looks like this.
-### Audit Report
-Enable the second output to get a full compliance trail:
-```json
-{
-  "totalHits": 7,
-  "hitsByCategory": { "contact": 3, "identity": 2, "financial": 2 },
-  "hitsByPattern": { "EMAIL": 2, "PHONE": 1, "SSN": 1, "CREDIT_CARD": 1, "PERSON": 2 },
-  "hits": [...]
-}
 ```
-### Validation - Not Just Regex
-Credit card numbers are **Luhn-checked**. IBANs are **checksum-verified** (ISO 13616). NHS numbers pass **mod-11 validation**. This means fewer false positives and less over-redaction that kills your LLM output quality.
----
-## Installation
-### From n8n (Recommended)
-1. Go to **Settings > Community Nodes**
-2. Enter `n8n-nodes-redactor`
-3. Click **Install**
-4. Done. The "Redactor" node appears in your node palette.
-### Manual
-```bash
-cd ~/.n8n/nodes
-npm install n8n-nodes-redactor
-# Restart n8n
+Data source > Detect > Redact > LLM > Verify > Restore > Output > Purge
 ```
----
-## Quick Start (2 minutes)
-1. **Install** the node
-2. **Add "Redactor"** to your workflow, set operation to **Redact**
-3. **Connect it** before your OpenAI/Claude/Gemini node
-4. **Add another "Redactor"** after the LLM node, set operation to **Restore**
-5. Both nodes share the same Session ID (defaults to the execution ID, so a full run works automatically). Testing one step at a time? Set the same fixed Session ID, for example `test-1`, on both nodes.
-6. **Run your workflow.** Customer data stays on your server.
-That's it. No configuration needed for the default case.
----
-## Who this is for
-- **n8n consultants** building AI workflows for clients who ask "is our data safe?"
-- **Agencies** delivering GDPR-compliant automation for EU clients
-- **Companies** processing customer support tickets, emails, or documents through LLMs
-- **Healthcare** organizations that need HIPAA compliance before sending data to AI
-- **Anyone** who lies awake thinking about what happens when customer data hits an external API
----
-## We build GDPR-compliant AI workflows. For a living.
-We've delivered n8n + AI automation for clients across **e-commerce**, **healthcare**, **financial services**, and **consulting**. The GDPR question around client data hitting external APIs keeps coming up. We built this node because we needed it for real client projects.
-**This node exists because we solve this problem every day.**
-If you need help setting up PII-safe AI workflows, custom redaction rules, or end-to-end GDPR-compliant automation - we've done it before and would be happy to do it for you.
+## Redaction modes
-<p align="center">
-  <a href="https://services.next8n.com"><img src="https://img.shields.io/badge/Book_a_Free_Consultation-services.next8n.com-FF6D5A?style=for-the-badge&logoColor=white" alt="Book a consultation" /></a>
-</p>
-<p align="center">
-  <a href="https://next8n.com"><strong>next8n.com</strong></a> &nbsp;|&nbsp; <a href="https://services.next8n.com"><strong>Schedule a call</strong></a>
-</p>
----
-## Enterprise Features
-### 7 Redaction Modes
 | Mode | Output | Reversible | Best for |
-|------|--------|------------|----------|
-| **Token** | `[EMAIL_0]` | Yes | LLM workflows |
-| **Mask** | `j***@e***.com` | No | Logs, dashboards |
-| **Hash** | `[EMAIL:a3f2b8c91d4e]` | No | Analytics |
-| **Redact** | `[REDACTED]` | No | Maximum privacy |
-| **Pseudonymize** | `sarah.miller@example.com` | Yes | GDPR pseudonymization, demo data, QA |
-| **Blackout** | `████████` | No | Visual censoring, like a black marker |
-| **Remove** | *(empty string)* | No | Complete deletion, no trace left |
-### Confidence Scoring and Threshold
-Every detection gets a confidence score (0.0 to 1.0). Set a threshold to only redact high-confidence matches. Checksum-validated patterns (credit cards, IBANs) score 0.95. Broad patterns score lower. Reduces false positives by up to 50%.
-### Allow and Deny Lists
-- **Allow List**: Values to NEVER redact (company email domains, public phone numbers)
-- **Deny List**: Values to ALWAYS redact (project codenames, internal secrets)
-### Prompt Injection Detection
-Scans input data for 25+ prompt injection patterns before it reaches an LLM. Detects instruction overrides, jailbreaks, delimiter escapes, encoded payloads, and zero-width character injection. Returns BLOCK/FLAG/CLEAN with a composite threat score.
-### Data Classification
-Assigns sensitivity labels (PUBLIC / INTERNAL / CONFIDENTIAL / RESTRICTED) based on what PII categories are found. Escalation rules: 10+ CONFIDENTIAL hits escalate to RESTRICTED. Maps directly to enterprise data governance policies.
-### Vault Encryption (AES-256-GCM)
-Encrypt vault files at rest with a passphrase. Each tenant uses a different passphrase for complete isolation. Even with filesystem access, encrypted files are unreadable without the key. scrypt key derivation resists brute-force attacks.
-### Persistent Audit Log
-JSONL audit log of all redaction activity. Compatible with Splunk, ELK, Datadog. Daily rotation + 100MB size limit. Self-hosted n8n only. Helps you meet GDPR Art.30, HIPAA, SOX and PCI DSS record-keeping, which still depends on how you store and retain the files.
-### GDPR Art.30 ROPA Report
-Adds a structured Records of Processing Activities entry to the Redact report output, covering the fields in GDPR Article 30(1): controller, purposes, legal basis, data subjects, personal data categories, recipients, retention, and security measures. Detection results fill it in, you supply the controller details in the node.
-### Per-Tenant Profiles
-Coming in 2.0.0. Per-client redaction settings (patterns, allow and deny lists, threshold, mode) supplied as JSON in the node, so they work on n8n Cloud too. Earlier docs listed this as available; it was not reachable from the node and is being rebuilt.
----
-## Enhanced NLP Detection (Optional Presidio Integration)
+|---|---|---|---|
+| Token | `[EMAIL_0]` | Yes | LLM workflows, the default |
+| Pseudonymize | `sarah.miller@example.com` | Yes | Demo data, QA, GDPR pseudonymization |
+| Mask | `j***@e***.com` | No | Logs and support tickets |
+| Hash | `[EMAIL:a3f2b8c91d4e]` | No | Analytics and deduplication |
+| Redact | `[REDACTED]` | No | Maximum privacy |
+| Blackout | `████████` | No | Visual censoring |
+| Remove | empty string | No | Leaving no trace |
+## What it detects
+216 patterns across 11 categories.
+| Category | Examples |
+|---|---|
+| Contact | Email, international and UK phone numbers, titled person names |
+| Financial | Credit cards (Luhn), IBAN (ISO 13616), BIC, EU VAT numbers, UK bank accounts |
+| Government IDs | 25+ countries, including US SSN, UK NINO and NHS, German Steuer-ID and Personalausweis, Spanish DNI and NIE, Dutch BSN, Polish PESEL, Indian Aadhaar and PAN, Brazilian CPF |
+| Network | IPv4, IPv6, MAC addresses, URLs, Bitcoin and Ethereum addresses |
+| Location and dates | US ZIP, UK postcodes, GPS coordinates, dates and dates of birth |
+| Medical | Medical record numbers |
+| Infrastructure | Internal hostnames, UNC paths, LDAP names, connection strings, cloud API keys, JWTs, PEM keys, Slack webhooks |
+| Vehicle | VIN, German, UK and French plates |
+| Digital identity | UUIDs, social handles, IMEI, ICCID |
+| Custom | Your own regex patterns, for example `ORD-\d{6}` |
+## Features in detail
+| Feature | Detail |
+|---|---|
+| Deduplication | The same value gets the same token everywhere, so the model keeps relationships between fields |
+| Field targeting | Allowlist or denylist paths such as `user.email`, `*.phone` or `metadata.*` |
+| Vault | In memory, or file based in `~/.n8n/pii-vault/` so it survives restarts. Sessions expire after 60 minutes by default |
+| Vault encryption | AES-256-GCM with scrypt key derivation, one passphrase per tenant |
+| Confidence threshold | Each match carries a 0.0 to 1.0 score. Checksum validated patterns score 0.95 |
+| Allow and deny lists | Values to never redact, such as your support address, and values to always redact, such as project codenames |
+| Prompt injection check | 25+ patterns, including instruction overrides, delimiter escapes, encoded payloads and zero width characters. Returns BLOCK, FLAG or CLEAN |
+| Audit report | A second output with hits by category and pattern |
+| Audit log | JSONL with daily rotation and a 100 MB cap, readable by Splunk, ELK and Datadog |
+| ROPA record | Turn on Include Audit Report, then Include GDPR Art.30 ROPA Record, and fill in the controller details |
+| Presidio | Optional Microsoft Presidio container for names and organisations in free text. See [docs/PRESIDIO_SETUP.md](https://github.com/mjmirza/n8n-nodes-redactor/blob/master/docs/PRESIDIO_SETUP.md). Falls back to built-in patterns when unreachable |
+| Per-tenant profiles | Planned for 2.0.0 as JSON settings in the node |
+This node reduces what reaches a model. It is not legal advice and does not on its own make a workflow GDPR or HIPAA compliant.
+## For developers
+| Area | Detail |
+|---|---|
+| Language | TypeScript, strict mode |
+| Runtime dependencies | None. Only `n8n-workflow` as a peer |
+| Tests | Jest, run on every push in CI |
+| Node.js | 24, as pinned in `.nvmrc` and CI. Node 26 has no prebuilt `isolated-vm`, which `n8n-workflow` loads in tests |
-For users who need NLP-level accuracy in detecting person names, locations, and organizations in free text, the node optionally integrates with Microsoft Presidio (open source, MIT license).
-**What it adds:** Catches "Sarah Johnson" and "Goldman Sachs" in free text paragraphs that regex alone cannot detect.
-**Setup (one command):**
 ```bash
-docker run -d -p 5002:3000 mcr.microsoft.com/presidio-analyzer
+npm ci
+npm run typecheck
+npm run lint
+npm test
+npm run build
 ```
-**In the node:** Toggle "Enhanced NLP Detection" to ON, enter `http://localhost:5002`. Done.
-**No Presidio? No problem.** The node works perfectly without it. Presidio is an optional upgrade for maximum accuracy. If the container is unreachable, the node falls back silently to regex-only detection.
-For docker-compose setup and language configuration, see [docs/PRESIDIO_SETUP.md](https://github.com/mjmirza/n8n-nodes-redactor/blob/master/docs/PRESIDIO_SETUP.md).
----
-## Missing a use case? We'll build it for you.
-This node ships 216 built-in patterns. But every business has unique data: internal codes, proprietary identifiers, industry-specific formats.
-**You can add your own patterns directly in the node UI** using the Custom Patterns section. Define any regex, give it a label, and the engine will detect and redact it alongside the built-in patterns.
-If there is a specific use case that is not covered here and you want us to cover it so that everyone can benefit from it, or if you want a customized implementation built on top of this node, **reach out to us and we will be happy to enhance it accordingly.**
+Project layout:
+- `nodes/Redactor/` holds the node, the detection engine, patterns, vault and reports
+- `test/` holds the Jest suites
+- `tools/check-tarball.sh` makes sure only the built node ships to npm
+- `.github/workflows/` holds CI and the signed publish workflow
-<p align="center">
-  <a href="https://services.next8n.com"><img src="https://img.shields.io/badge/Request_a_Custom_Pattern_or_Feature-services.next8n.com-7B61FF?style=for-the-badge&logoColor=white" alt="Request a feature" /></a>
-</p>
----
+Releases are cut by pushing a `vX.Y.Z` tag. The publish workflow tests, builds and publishes with npm provenance.
-## Also by next8n
+## Support
-<p align="center">
-  <a href="https://www.npmjs.com/package/n8n-nodes-xentral"><img src="https://img.shields.io/badge/n8n--nodes--xentral-30_Resources_|_163_Operations_|_58_Webhooks-00C4B4?style=for-the-badge" alt="n8n-nodes-xentral" /></a>
-</p>
-**[n8n-nodes-xentral](https://www.npmjs.com/package/n8n-nodes-xentral)** - The most comprehensive n8n community node for Xentral ERP. 30 resources, 163 operations, 58 webhook events. Full API audit verified. If you're automating Xentral workflows, this is the node you need.
----
+- Custom patterns, new use cases or setup help go to [services.next8n.com](https://services.next8n.com)
+- Bugs and feature requests go to [GitHub issues](https://github.com/mjmirza/n8n-nodes-redactor/issues)
+- Also by next8n, [n8n-nodes-xentral](https://www.npmjs.com/package/n8n-nodes-xentral) for Xentral ERP
 ## License
-MIT. See [LICENSE](LICENSE). Copyright (c) 2026 Mirza Iqbal / [next8n](https://next8n.com).
-Free to use, modify and redistribute, including commercially, as long as the copyright notice stays in place. Provided "as is", without warranty. This node helps you reduce what reaches an LLM; it is not legal advice and does not by itself make a workflow GDPR or HIPAA compliant.
-For partnership or custom development: [services.next8n.com](https://services.next8n.com)
+MIT. See [LICENSE](LICENSE). Copyright (c) 2026 Mirza Iqbal, [next8n](https://next8n.com).

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "n8n-nodes-redactor",
-  "version": "1.11.0",
+  "version": "1.11.1",
   "description": "Redact, mask and anonymize PII before it reaches an LLM, then restore it. 216 patterns for emails, phones, addresses, IBAN, cards, names, SSN, passport and tax IDs. Reversible vault, GDPR Art.30 ROPA record, prompt-injection check. Runs locally. For n8n 2.x.",
   "keywords": [
     "n8n-community-node-package",