Data Masking
Data masking controls what personally identifiable information (PII) is visible to the AI when answering your questions. Bellwether applies masking before your data reaches Claude, so sensitive details can be protected at the point of processing.
How Masking Works
When Bellwether fetches records from your ChMS to answer a question, it can redact or obscure specific fields before sending them to the AI model. For example, phone numbers might be replaced with a placeholder so the AI can still reference “this person” without seeing the actual number.
The AI works with the masked version of the data. It can still identify people by name and answer questions about relationships, attendance, and groups — but the specific PII fields you’ve chosen to mask won’t be part of what the AI processes.
What Can Be Masked
Bellwether supports masking for:
- Phone numbers — Replaced with a placeholder
- Email addresses — Replaced with a placeholder
- Street addresses — Replaced with city/state only or fully masked
- Birth dates — Replaced with age range or fully masked
Configuring Masking
Masking presets are configured at the organization level. Go to Settings from your dashboard to see the current masking configuration. The default preset masks phone numbers and full addresses while keeping names and email addresses visible.
You can adjust these settings based on your church’s comfort level. Stricter masking means the AI sees less PII but may be less able to help with contact-related questions. More permissive masking gives the AI more context but sends more PII through the processing pipeline.
The Tradeoff
There’s an honest tradeoff here. More aggressive masking means better PII protection but reduces what Bellwether can do. If email addresses are masked, it can’t tell you “which visitors left contact info.” If names are masked, it can’t refer to specific people in its responses.
Most churches find the default preset strikes the right balance — names and emails visible, phone numbers and street addresses masked. But every congregation has different expectations around data handling, and you should configure masking to match yours.