Canadian SIN: format, validation and detection

What it is

The SIN identifies people for Canadian employment and tax purposes. Maskflare's Canada pack covers it as a social security number, and an unformatted sibling detector handles nine-digit runs with no spaces.

In Maskflare this is the detector ca_sin, labelled "Canada - Social insurance number (SIN)", category social security number, in the Canada pack.

Format and layout

• Nine digits, usually printed in groups of three: 130 692 544.
• The first digit cannot be 0 or 8.

How the check works

Luhn over all nine digits: double every second digit counting from the right, subtract 9 from results over 9, add everything, and require a multiple of 10.

Worked example

1. Doubling the second, fourth, sixth and eighth digits from the right and reducing results over 9 gives 1, 6, 0, 3, 9, 4, 5, 8, 4.
2. The total is 40, a multiple of 10, so the number passes.

Valid and invalid examples

In running text the valid example reads, for instance, SIN 130 692 544. The invalid one is left alone: a value that fails the validator is treated as an ordinary string.

Regex and validation caveats

• The unformatted detector needs one of five keywords before a bare nine-digit run, because Luhn passes one in ten random numbers.
• No Canadian compliance profile exists in Maskflare, so this detector is controlled by the organisation's primary country setting.

How to detect it in LLM traffic

Canadian SIN values reach an LLM inside ordinary work rather than as standalone data: a pasted block of HR or payroll rows, a customer-support thread, an onboarding or identity-check form, a spreadsheet someone wants summarised, or an email they want rewritten. The model needs none of the digits for any of those jobs, so the safest place to remove them is before the request leaves the company.

Maskflare reads the whole request body, including the system prompt, earlier messages and tool arguments, so a number buried in the fourth message of a long chat is found as readily as one in the latest message. Each match is replaced with a token such as mf_mask_d7e0 before the request goes out, and with response restoration turned on the real value is put back into the answer for the person who is allowed to see it.

If you build the detection yourself

1. Strip spaces, dots and hyphens before running any arithmetic, but remember where they were so the original text can be replaced exactly.
2. Match the shape with a pattern anchored on word boundaries, so that a long digit string is not read as several shorter Canadian SIN candidates.
3. Run the check from the section above. A failing check is almost always a typo or a made-up value; a passing one removes most look-alikes.
4. Replace the value before the text is sent anywhere, and keep a mapping if the answer has to be restored afterwards.

How Maskflare handles it

• Protect now, Finance - Protect now, Healthcare and Developer: mask (a reversible token) when Canada is a primary country.
• Monitor first: alert (counted, forwarded unchanged) when Canada is a primary country.

The available actions are mask (reversible token), redact, partial, hash, format-preserving encryption, generalize, alert and block. Masked values are kept encrypted for 30 days so that answers can be restored, then they expire; prompts and responses are not logged. The full list of detectors is in the detector reference.

Compliance profiles that include it

None of the 6 compliance profiles (HIPAA Safe Harbor, GDPR (EU/EEA), UK GDPR, PCI DSS v4.0, US PII (CCPA/CPRA) and Swiss nDSG health data) includes the Canada pack, so no profile turns this detector on. It runs when the pack is enabled directly, or when Canada is chosen as a primary country.