Identifier detector
French NIR (social security number): format, validation and detection
Short answer
A French NIR has 15 characters: 13 for the number and a two-digit key equal to 97 minus the number modulo 97. Corsican departments 2A and 2B are treated as 19 and 18 for the calculation.
What it is
The NIR (numéro d'inscription au répertoire), often called numéro de sécu, is the French social security number. Maskflare keeps it in the France pack and the GDPR (EU/EEA) profile includes the pack.
In Maskflare this is the detector fr_nir, labelled "France - Social security number (NIR)", category social security number, in the France pack.
Format and layout
- 15 characters, printed in groups such as 1 23 45 67 890 123 11.
- The first digit is 1, 2, 3, 4, 7 or 8.
- Digits 4 and 5 are a month field from 01 to 12 or 20 to 99; the department field is two digits or 2A / 2B; then a three-digit commune and a three-digit order number.
- The last two digits are the key.
How the check works
Read the first 13 characters as one number (with 2A as 19 and 2B as 18 if they appear in the department field). The key is 97 minus the remainder of that number divided by 97.
Worked example
- The 13-digit body is 1234567890123.
- 1234567890123 divided by 97 leaves 86.
- 97 minus 86 is 11, the key at the end of the example.
Valid and invalid examples
| Example | Result | Why |
|---|---|---|
1 23 45 67 890 123 11 | Valid | Matches the layout and passes the validator. |
1 23 45 67 890 123 10 | Invalid | The invalid example changes one character, the last character: 1 becomes 0. |
In running text the valid example reads, for instance, NIR 1 23 45 67 890 123 11. The invalid one is left alone: a value that fails the validator is treated as an ordinary string.
Regex and validation caveats
- A 15-digit run with no spaces is masked unless a word like order or invoice sits closer to it than one of the detector's keywords (NIR, INSEE, numero de secu).
- A key check of two digits passes about one in 97 random bodies, so the filter is strong.
- The pattern allows spaces between the groups but not other separators.
Words that confirm it
The formatted shape is masked without a keyword. For a run with no separators, these words count as the detector's own keywords when a word like order, invoice or phone is also close: insee, nir, numero de secu, numéro de sécu, securite sociale, social insurance, social security, ssn, sécu, sécurité sociale. The nearer word wins.
How to detect it in LLM traffic
French NIR (social security number) values reach an LLM inside ordinary work rather than as standalone data: a pasted block of HR or payroll rows, a customer-support thread, an onboarding or identity-check form, a spreadsheet someone wants summarised, or an email they want rewritten. The model needs none of the digits for any of those jobs, so the safest place to remove them is before the request leaves the company.
Maskflare reads the whole request body, including the system prompt, earlier messages and tool arguments, so a number buried in the fourth message of a long chat is found as readily as one in the latest message. Each match is replaced with a token such as mf_mask_d7e0 before the request goes out, and with response restoration turned on the real value is put back into the answer for the person who is allowed to see it.
If you build the detection yourself
- Strip spaces, dots and hyphens before running any arithmetic, but remember where they were so the original text can be replaced exactly.
- Match the shape with a pattern anchored on word boundaries, so that a long digit string is not read as several shorter French NIR (social security number) candidates.
- Run the check from the section above. A failing check is almost always a typo or a made-up value; a passing one removes most look-alikes.
- Treat a run with no separators more carefully than a formatted one: reject it when a word such as order, invoice, phone or reference is nearer to it than one of the identifier's own keywords.
- Replace the value before the text is sent anywhere, and keep a mapping if the answer has to be restored afterwards.
How Maskflare handles it
- Protect now, Finance - Protect now, Healthcare and Developer: mask (a reversible token) when France is a primary country.
- Monitor first: alert (counted, forwarded unchanged) when France is a primary country.
The available actions are mask (reversible token), redact, partial, hash, format-preserving encryption, generalize, alert and block. Masked values are kept encrypted for 30 days so that answers can be restored, then they expire; prompts and responses are not logged. The full list of detectors is in the detector reference.
Compliance profiles that include it
One compliance profile includes the France pack, and applying it turns this detector on: GDPR - EU/EEA. For the GDPR (EU/EEA) profile the France pack is one of the country packs the administrator can choose from; the profile turns on the ones chosen. A profile is a floor: it never turns anything off or weakens a rule that is already stricter.
Frequently asked questions
How is the NIR key calculated?
Take the 13-digit number, divide it by 97, and subtract the remainder from 97. For Corsica replace 2A with 19 and 2B with 18 first.
Does Maskflare check that the month is real?
Only loosely: the pattern accepts months 01 to 12 and also 20 to 99, because some NIRs use special values in that field.
Is the French NIR (social security number) detector on by default?
It depends on the organisation's primary countries. It is part of the France pack, which the default Protect now template turns on with the action mask when France is a primary country.
Does a valid French NIR (social security number) prove the person exists?
No. A check digit shows the value is well formed. Many valid-looking numbers have never been issued, and Maskflare masks them all the same.
Rules on this page describe what Maskflare's detectors and validators check. They are read from the detection catalogue and are not the specification of the body that issues the identifier. Examples are synthetic.