Sensitive data: United States vs France, what changes

Sensitive data doesn't take the same shape in the United States and in France: a US SSN (9 digits) is nothing like a French social security number (15 digits), and an EIN or a ZIP code has no direct equivalent in French formats (SIREN, postal code, IBAN). Practical consequence: an effective detection engine must be country-aware — adapting its rules to the country, or it misses identifiers and multiplies false positives.

Personal identifiers: different formats

• United States: SSN (9 digits), sometimes formatted 123-45-6789.
• France: social security number (15 digits, with a check key).
• Phone, address, date: distinct conventions and formats (MM/DD vs DD/MM).

Corporate and tax identifiers

• United States: EIN (employer ID), bank routing/account numbers.
• France: SIREN/SIRET, IBAN, tax identifier.
• Addresses: ZIP code (5 digits) vs French postal code (5 digits, different logic).

Why detection must be country-aware

Applying French rules to a US text (or vice versa) creates two problems: leaks (an unrecognized SSN isn't masked) and noise (digit strings wrongly taken for identifiers). Adapting detectors to the country — formats, lengths, check keys — improves both recall and precision.

Beyond FR and US

Many organizations operate across several countries. The ideal is to choose the detection country, with solid coverage where it exists and a reasonable fallback elsewhere — while clearly flagging when a country's rules aren't yet optimal.

ONYRI Sanitize offers country-aware detection (full FR and US rules: SSN, EIN, ZIP, US dates… on the US side; social security, SIREN, IBAN… on the FR side), with the ability to add your own business rules.