Telecommunications
Use AI in Telecoms Without Sending Subscriber Data to the Model
- 01
Identify sensitive values
- 02
Replace with stable tokens
- 03
On API traffic, restore inside your boundary
574
Built-in detectors for personal data and secrets
47
Country packs, checksum-validated where the format has one
9
AI providers behind one gateway, plus the desktop agent and proxy
Where subscriber data meets AI at an operator
A support agent has a billing dispute and pastes the ticket into a chatbot for a reply. It holds the subscriber's name, mobile number, address and account number, and sometimes the numbers they called. A network engineer pastes log lines to explain an outage, and they contain IP addresses, device identifiers and timestamps tied to customers. A developer tests a chatbot for the contact center with real transcripts.
Telecoms data is sensitive in a particular way. Traffic and location data can reveal who someone speaks to and where they go, and the confidentiality of communications has its own legal protection on top of data protection law. A few lines of logs can say more about a person than a customer record does.
Maskflare applies one rule set across these routes: the desktop agent and browser protection for support and engineering, the gateway for customer-facing assistants, and hooks for coding agents. Built-in detectors cover phone numbers, IMEIs, IPs and MAC addresses, while operator-specific identifiers such as IMSIs and ICCIDs need rules that you add.
Where telecommunications is actually exposed
5 failure modes specific to this environment, not a restatement of general security advice.
01
Support tickets pasted for a reply
A ticket carries a name, mobile number, address and account number. The desktop agent masks them before the prompt reaches ChatGPT, Claude, Gemini, DeepSeek, Perplexity, Mistral Le Chat and Microsoft 365 Copilot. The reply may show tokens where it refers to them, and the agent fills those in or keeps them.
02
Network logs shared for troubleshooting
Logs hold IP and MAC addresses, device IDs and timestamps. Detectors mask the addresses and IMEIs. Consider what's left, because a timestamp and a cell ID can still describe someone's movements.
03
IMSIs, ICCIDs and account numbers
SIM identifiers and your account number formats have no built-in detector. Add custom regex rules or use Exact Data Match on your subscriber records, so they're masked as reliably as an IBAN.
04
Contact center assistants and call transcripts
Assistants built on third-party models receive customer text by default. The gateway masks it through a base-URL change, including while streaming, and text events in realtime voice sessions are masked. Audio isn't.
05
Coding agents on operational systems
Engineers point coding agents at configs and real data. Hooks for Claude Code, OpenAI Codex, Cursor, GitHub Copilot CLI and VS Code agent mode mask tool input and output, and block prompts containing secrets such as API keys and connection strings.
Who this page is for
- Head of customer care
- Wants faster replies from AI without each ticket sending subscriber details to a provider.
- Network operations lead
- Needs engineers to get troubleshooting help without customer identifiers in the logs they share.
- Data protection officer
- Has to account for traffic and location data, which carry stricter rules than ordinary customer data.
- CISO
- Needs AI use covered in a NIS2 risk program, across staff tools, assistants and coding agents.
- AI and digital product lead
- Wants to ship a contact center assistant without a long privacy review of every prompt path.
How a team would actually run this
Helping support agents draft replies
- 01 Deploy the desktop agent to support teams with Intune, Jamf or Group Policy, or use the forward proxy for shared or virtual desktops.
- 02 Apply the GDPR profile with your country packs, and PCI DSS v4.0 if agents see card numbers.
- 03 Add custom rules for account numbers and SIM identifiers, or upload subscriber records to Exact Data Match.
- 04 The agent pastes the ticket. The provider sees tokens. The reply may show those tokens where it refers to masked details, and the agent fills them in before sending.
Shipping a contact center assistant
- 01 Point the assistant's SDK at the Maskflare gateway, which is a base-URL change.
- 02 Run in alert mode against test traffic to measure what turns up in real transcripts.
- 03 Move rules to mask with maker-checker approval, and restore values in the response per gateway key.
- 04 Send events to your SIEM, with metadata only, so operations can watch for spikes by category.
Which modules apply, and why
Each links to the module page, where the boundaries and development status are set out in full. Or start at the Maskflare platform overview.
Detection engine
Maskflare Detection Engine
Detects and masks names, phone numbers, IMEIs, IP addresses, IBANs and cards before a prompt reaches an AI provider, and on API traffic restores them in the answer.
For your apps
Maskflare AI Gateway
Puts contact center assistants behind the same rules with a base-URL change, including streaming.
For your people
Maskflare Workforce
The desktop agent covers support and engineering staff on AI chat sites, deployed through device management.
For your people
Maskflare Forward Proxy
Covers tools and shared desktops where an agent can't be installed.
Detection engine
Maskflare Exact Data Match
Masks your subscriber and account numbers from keyed hashes of your records, with no clear values sent.
For your agents
Maskflare Coding Agents
Keeps secrets and customer data out of the prompts and tool calls of coding agents.
The data, and how it's found
Typical data in this sector, the detectors that cover it, and where you'll need your own rules.
| Data | How Maskflare finds it | Profile or rule |
|---|---|---|
| Phone numbers | International and grouped formats, with domestic formats by country pack | GDPR, US PII |
| IMEIs | IMEI detection with the Luhn checksum and keywords | GDPR, UK GDPR, US PII |
| IP and MAC addresses | Global pack detectors | GDPR, HIPAA Safe Harbor |
| Names and postal addresses | Person names pack, local named-entity layer, address detectors | GDPR, UK GDPR |
| Cards and IBANs | Checksum validation | PCI DSS v4.0, GDPR |
| API keys and connection strings | 232 credential formats | Every profile; block rule recommended |
| IMSIs, ICCIDs and account numbers | No built-in detector: custom regex or Exact Data Match | Your own rules |
| Cell IDs, location and call records | No built-in detector: custom rules, or keep them out by policy | Your policy decision |
Regulatory context
Readiness and relevance, not certification. Nothing here is a claim to hold an audit or authorization we do not have.
- ePrivacy Directive 2002/58/EC
- Protects the confidentiality of communications, and limits how traffic and location data can be used. Masking reduces what reaches a provider, and it doesn't create a legal basis for using that data.
- GDPR
- Applies to subscriber data. Reversible tokens remain pseudonymized personal data for you, so your legal basis still applies.
- NIS2 Directive
- Covers providers of public electronic communications networks and services, and requires risk management, including for supply chains. AI providers, and Maskflare, are suppliers to assess in that program.
- Swiss Telecommunications Act Art. 43
- Sets telecommunications secrecy for Swiss providers. The revised FADP also applies. On-premises deployment can help keep processing in-house, and legal assessment stays with you.
- US CPNI rules (47 U.S.C. § 222)
- Restrict use of customer proprietary network information. The US PII profile covers common identifiers, but it isn't a CPNI compliance program.
What Maskflare does not do
- IMSIs, ICCIDs, cell IDs and call records have no built-in detector. Add rules for them, or keep them out by policy.
- Audio in realtime voice sessions isn't masked; text events are.
- Masking identifiers doesn't anonymize traffic or location data. Patterns in timing and location can still identify a person.
- It doesn't run in your network core or inspect subscriber traffic. It only sees traffic going to AI providers from your people and apps.
- Documents, including scanned pages read with OCR, are scanned under your document policy and recorded or refused, not rewritten. In browser apps, picture uploads pass unread or are refused, and uploads that go to a separate storage host are refused.
- SOC 2 Type II and ISO 27001 audits are in progress.
5 questions to ask any vendor here
Including us. If our answer is worse than someone else's, you should know that before you buy, not after.
- 01Does the provider ever receive a phone number, IMEI or IP address, or only tokens?
- 02Which identifiers aren't built in, such as IMSIs, and how do we add them?
- 03What's left in a log line after masking, and could it still locate someone?
- 04Does it cover streaming and realtime voice, and what isn't covered in voice?
- 05How does it behave if masking fails on a customer-facing route?
Workflow guides for this industry
How a team applies each of these, including the contrast with the tool it replaces.
Definitions worth agreeing on first
Telecommunications questions we get asked
Does Maskflare detect IMSI and ICCID numbers?
Not out of the box. IMEIs, phone numbers, and IP and MAC addresses are built in. Add a regex rule for IMSIs and ICCIDs, or upload known values to Exact Data Match.
Can support agents paste tickets into ChatGPT?
With the desktop agent installed, names, numbers and addresses are masked before the ticket reaches ChatGPT. The answer may show tokens where it refers to them, and the agent fills those in. Call records and location details need your own rules, so decide with your DPO what may be sent. This is not legal advice.
Does it work with a contact center assistant?
Yes, through the gateway, including streaming, and values can be restored in the response. For realtime voice, text events are masked, while audio isn't.
Is masked log data anonymous?
No. Tokens are reversible for you, and timing or location patterns can still identify someone. Treat it as personal data and limit what you send.
Does Maskflare inspect subscriber traffic?
No. It sits on the path between your own staff, apps and agents and the AI providers. It isn't deployed in your network core and doesn't see subscribers' traffic.
Where is Maskflare hosted?
In the EU by default, with on-premises deployment available for enterprise. Prompts and responses are never stored; masked values are kept encrypted for 30 days so answers can be restored.
See it on your own data
Start a free trial or talk to us with the identifiers and AI workflows your telecommunications team actually handles. Bring the case that makes it hard, because that is the part worth testing.
See it on your own data
Try Maskflare free.
Bring your hardest prompts.
28-day free trial or 10,000 requests, whichever comes first. Point one app at the gateway or enroll a few laptops,
and watch what gets masked. Or talk to us first.
- SOC 2 Type II: In progress
- ISO 27001: In progress
- EU hosting by default · on-premises available
- Prompts and files never stored
- Never used to train AI models
- GDPR · nDSG · DPA available
- Trust center →