LiveChatSensitiveDataRule in SFDX

Architectural Overview#

LiveChatSensitiveDataRule is a compliance metadata asset in Salesforce Service Cloud. Organizations subject to industry security frameworks—such as PCI-DSS (Payment Card Industry Data Security Standard), HIPAA (Health Insurance Portability and Accountability Act), and GDPR—must ensure that personally identifiable information (PII) and cardholder data are not stored in plaintext across chat transcripts.

Architecturally, LiveChatSensitiveDataRule functions as an in-stream regex interceptor. When a customer or agent types a sensitive string (such as a 16-digit credit card number or national identity number), the rule intercepts the message payload before it is written to the LiveChatTranscript record or rendered on the supervisor monitoring console, replacing sensitive characters with mask strings (for example, XXXX-XXXX-XXXX-1234).

Directory and File Conventions#

Sensitive data rules are stored in the liveChatSensitiveDataRules directory:

Key Metadata Fields#

The LiveChatSensitiveDataRule schema exposes regular expression parsing fields:

Declarative XML and Package Manifest Examples#

Below is a production Credit_Card_Masking.liveChatSensitiveDataRule configuration:

<?xml version="1.0" encoding="UTF-8"?>
<LiveChatSensitiveDataRule xmlns="http://soap.sforce.com/2006/04/metadata">
    <developerName>Credit_Card_Masking</developerName>
    <masterLabel>Credit Card Number Masking Rule</masterLabel>
    <actionType>Replace</actionType>
    <description>Masks Visa, Mastercard, and Amex credit card numbers in real time</description>
    <enforceOn>Visitor</enforceOn>
    <enforceOn>Agent</enforceOn>
    <isActive>true</isActive>
    <pattern>\b(?:\d[ -]*?){13,16}\b</pattern>
    <replacement>[CARD REDACTED]</replacement>
</LiveChatSensitiveDataRule>

Manifest Definition (package.xml)#

Include the rule in package.xml:

<?xml version="1.0" encoding="UTF-8"?>
<Package xmlns="http://soap.sforce.com/2006/04/metadata">
    <types>
        <members>Credit_Card_Masking</members>
        <name>LiveChatSensitiveDataRule</name>
    </types>
    <version>68.0</version>
</Package>

CLI Retrieval and Deployment Commands#

Use the Salesforce CLI to deploy sensitive data rules:

# Retrieve all sensitive data rules
sf project retrieve start --metadata LiveChatSensitiveDataRule

# Deploy the masking rule across test and production orgs
sf project deploy start --source-dir force-app/main/default/liveChatSensitiveDataRules/Credit_Card_Masking.liveChatSensitiveDataRule

Senior Architect Deployment Best Practices and Gotchas#

• RegEx Escape Characters in XML: Remember that backslashes must be properly escaped inside XML tag payloads (for example, \b for word boundaries and \d for numeric digits). Unescaped single slashes will cause metadata parsing failures during deployment.
• Rule Ordering and Performance: Keep the total number of active sensitive data rules reasonable (typically fewer than 10 rules). Because every incoming and outgoing keystroke is evaluated against active rules, overly complex regular expressions can introduce noticeable message rendering latency.
• Historical Transcripts: Deploying a LiveChatSensitiveDataRule only sanitizes future live chat sessions. It does not retroactively redact sensitive data from historical LiveChatTranscript records already committed to the database.

Frequently asked questions

What role does LiveChatSensitiveDataRule fulfill?

It automatically sanitizes customer and agent messages by replacing sensitive patterns like credit card numbers with masked characters.

Where are sensitive data rules stored in SFDX format?

They are saved in the liveChatSensitiveDataRules directory with the .liveChatSensitiveDataRule file extension.

Can you apply masking to agent whisper messages?

Yes, the enforceOn element can enforce masking on Agent, Visitor, and Supervisor whisper conversations.

What action types can be performed on matching data?

The rule can remove the sensitive content or replace it with a designated replacement string.