Your CDP holds data that not everyone needs to see. A tax ID, the last digits of a card, a home address. The agent handling a conversation doesn't need them to help, and not everyone on your team should read them.
You can now hide customer fields from AI agents and from teammates without access. The value is still stored and still works. What changes is who can read it.
How it works
Go to Settings › Sensitive data and turn on the switch for the field you want to hide. From then on:
- AI agents see
[redacted]in place of the value: in conversations, in the in-app assistant and in MCP tools. The agent knows the data exists, so it never asks the customer for it or tries to guess it. If it really needs it, it escalates the conversation. - Teammates without access see a Hidden lock in place of the value.
- Owner, Admin and Developer still see the value. Only Owners and Admins can change what's hidden; everyone else sees the page read-only.
A hidden field keeps working: your segments still filter on it and your messages can still use it. Nothing is deleted or re-synced.
What you can hide
- Contact fields every person has: email, phone number, first name and last name.
- People attributes: any field that comes from your integrations or imports.
- Custom object attributes: fields on records like orders, policies or accounts. A field with nested data is hidden whole.
The External ID can't be hidden: Boom uses it to recognize the same person across your systems.
If you hide the email and also have an email attribute that copies it, the page suggests it so you can hide it too. New attributes from a sync arrive visible, and a sync never changes what you've hidden.
First and last name are hidden separately. Hide only the last name and your team sees "Ana" with the lock, while the agent sees Ana [redacted].
In journeys and exports
If a journey message is about to send a hidden field, the builder warns you: sending it puts the value in the conversation, where the agent and the inbox can read it. It's a warning, not a block, because sometimes sending it is exactly what you want.
Exports follow the same rules. Someone without access can't download a segment's CSV while a contact field is hidden, and initiative participant exports write [redacted] in its place.
From the API and MCP
You can also mark fields with the REST API, with GET and POST /api/v1/cdp/sensitive-fields, up to 100 changes per call. Over MCP, a connected AI tool can hide a field but never show it again: that only happens in Settings or through the API.
Turn it on: ask Boom
Sensitive data is turned on per workspace. Write to us and we'll turn it on for your account. Nothing is hidden until you mark it.
We're still bringing the lock to a few screens; the documentation lists which ones.
