Data classification¶
Stackify can work out which of your columns hold personal or sensitive data — email addresses, personal identity numbers, salaries, health data — and tag them for you. Nothing is tagged automatically: every suggestion is shown to you first, and you decide what to accept.
Open it from a card: ⋯ (top right) → Data classification. Admins and owners only.
Why it matters¶
A column marked Personal data is hidden from members who don't have permission to see it — in the table, in exports, and through the API. That makes the tag genuinely useful, and it is also why suggestions are never applied behind your back: a wrong tag would hide a column people need, and a missing one would leave personal data exposed.
Scanning a card¶
Click Scan columns. Stackify samples up to 200 records and looks at two things for every column:
- The values. Email addresses, IP addresses, coordinates, IBANs, payment card numbers and personal identity numbers all have a recognisable shape, and the last three are checked against their own checksum — so a column of near-misses is not reported as a match. Personal identity numbers are date-checked too, so 30 February is rejected rather than tagged.
- Telephone numbers use Google's libphonenumber, which knows each country's numbering plan. That means a bare
0701234567is recognised as a Swedish mobile number with no formatting to go on — and a number no plan allows is not reported at all. - The column name, in English and Swedish. This is what catches columns whose values could be anything:
Lön,Diagnos,Efternamn,Fackförbund.
Swedish compound names are recognised as written, so you don't have to rename anything: Telefonnummer, Mobiltelefon, Bostadsadress, Leveransadress, Månadslön, Grundlön, Körkortsnummer, Passnummer, Diagnoskod and Kontaktnamn all match. So do camelCase headers from code-generated exports (phoneNumber, emailAddress).
The matching is deliberately narrow where a word is ambiguous: Belöning is not read as a salary, Holland is not read as a country, Lösenord is a credential rather than a passport, and Produktnamn, Filnamn and Företagsnamn are not read as people's names.
Each suggestion shows what was matched and how confident the result is:
| Evidence | Meaning |
|---|---|
| matched the values | The sampled values have the right shape (and checksum, where there is one) |
| matched the column name | The name is recognisable; the values were inconclusive |
| matched the values and the name | Both agreed — the strongest result |
Columns that look like nothing in particular are not reported. The summary line tells you how many were skipped, so a short list means "nothing else matched", not "the scan stopped early".
Reviewing and applying¶
Suggestions that would actually change something are ticked for you. Untick anything you disagree with, then click Apply. Only what is ticked is written.
Two things are deliberately not ticked by default:
- a suggestion that matches what the column is already tagged as — there is nothing to do; and
- a column you (or a colleague) set by hand. Those are skipped entirely unless you also tick Also apply to columns that were set by hand, so re-scanning a card can never quietly undo somebody's decision.
Setting a column by hand¶
The Columns section lists every column with:
- a Type dropdown — the semantic type (Email address, Personal identity number, Salary, Health data, …), or — for none;
- a Personal data checkbox — the tag that controls hiding; and
- sensitivity labels — Personal data, Confidential, Financial, Health, Public — used by the compliance report.
Picking a type fills in the usual personal-data flag and labels for it, which you can then adjust. Anything you set here is marked Set by hand and is protected from later scans.
Each row shows where its current classification came from: Set by hand, or Detected with the confidence of the scan you accepted.
On import¶
When you create a card from a file, the AI review step at the end of the import lists any columns that look like personal data, with a tickbox each. Accepting them there does exactly what applying a scan does — and skipping the step leaves everything untagged, which you can fix later with a scan.
What Stackify recognises¶
Identity and contact: email address, phone number, person's name, street address, postal code, city, country, date of birth, national identity number, passport number, driving licence, IP address, username, coordinates.
Financial: payment card number, IBAN, bank account, salary, amount, company/VAT number.
Special categories: health data, and other GDPR Article 9 data (religion, ethnicity, political opinions, union membership, sexual orientation, biometrics, criminal records).
Time periods: year, quarter, month, week — 2024 Q1, Q1 2024, 2024-Q1, 2024 K1, 2024-W10, 2024-03 are all recognised. These are classified, not converted into dates: a quarter names three months, so turning it into 1 January would show a day your file never contained.
A column of bare years (2024, 2023) is only suggested as a year when its name agrees — Verksamhetsår yes, Antal no. Four-digit numbers in that range are just as often quantities.
Other: credentials (passwords, API keys), web address, identifier.
A company registration number is recognised as a company number, not as personal data — even though a Swedish organisationsnummer has the same shape as a personnummer.