---
title: "What Locke detects"
description: "Read the Sonomos Support Center guide for What Locke detects. The full catalog of sensitive data types, by category, with risk levels."
url: "https://sonomos.ai/support/locke/data-types/"
source: "https://sonomos.ai/support/locke/data-types/"
---

Reference

# What Locke detects

All 78 built-in detection types, by category, with the risk level Locke assigns each one. Anything not on this list is what custom rules are for.

You switch these on and off individually under Controls › Detection data types — see [Controls](https://sonomos.ai/support/locke/controls/). Almost all of them are on out of the box.

## What the risk levels mean

| Level | Means |
| --- | --- |
| High | Directly harmful if exposed — identity theft, financial loss, or immediate system access. |
| Mid | Identifying or sensitive, but not immediately exploitable on its own. Dangerous in combination. |
| Low | Public or low-sensitivity identifiers. Masked mainly to avoid linking activity back to a person or organization. |

Risk level is not the same as confidence

Risk is how bad it would be if the value leaked. Confidence is how sure Locke is that it found one. A low-risk value can be detected with total certainty, and a high-risk one can be a close judgment call — which is why the Scanning floor dial exists.

## The five that start switched off

Everything else is enabled by default. These five are region-specific, and switching every country's formats on at once produces false alarms for people who never encounter them. If you work with these identifiers, switch them on:

- NHS Number (UK)
- National Insurance Number (UK)
- Social Insurance Number (Canada)
- Sort Code (UK)
- IFSC Code (India)

## The full catalog

Filter the catalog

78 of 78 types

### Personal & identity

Who someone is — the details that identify a specific human being.

| Type | Risk | Default |
| --- | --- | --- |
| Person Name | High | On |
| Email Address | Mid | On |
| Phone Number | Mid | On |
| Address / Location | Mid | On |
| Date of Birth | Mid | On |
| GPS Coordinate | High | On |
| Minor / Child Term | High | On |
| Passport Number | High | On |
| Driver License | High | On |

### Government & tax IDs

State-issued identifiers. Among the most damaging things to leak, and the hardest to change afterwards.

| Type | Risk | Default |
| --- | --- | --- |
| Social Security Number (US) | High | On |
| Individual Taxpayer ID Number (ITIN) | High | On |
| Employer Identification Number (EIN) | High | On |
| NHS Number (UK) | High | Off |
| National Insurance Number (UK) | High | Off |
| Social Insurance Number (Canada) | High | Off |

### Financial

Payment and banking details. Directly exploitable if they get out.

| Type | Risk | Default |
| --- | --- | --- |
| Credit Card | High | On |
| Card Verification Value (CVV) | High | On |
| Bank Account Number | High | On |
| ABA Routing Number | Low | On |
| IBAN | Mid | On |
| SWIFT / BIC Code | High | On |
| Sort Code (UK) | Mid | Off |
| IFSC Code (India) | Mid | Off |

### Health & medical

Clinical information and the codes that encode it. Regulated almost everywhere.

| Type | Risk | Default |
| --- | --- | --- |
| Health Term | High | On |
| Medical Record Number | High | On |
| Health Plan ID | High | On |
| DEA Number | High | On |
| NPI Number | Low | On |
| ICD-10 Diagnosis Code | High | On |
| CPT Procedure Code | High | On |
| HCPCS Code | High | On |
| NDC Drug Code | High | On |

### Secrets & credentials

Keys, tokens and connection strings. A leaked credential is a live door into a system.

| Type | Risk | Default |
| --- | --- | --- |
| API Key | High | On |
| Generic Secret | High | On |
| Private Key (PEM) | High | On |
| JWT Token | High | On |
| Bearer Token | High | On |
| Database URL | High | On |
| GCP API Key | High | On |
| Azure API Key | High | On |
| AWS Key | High | On |
| OAuth Token | High | On |
| Exchange API Key | High | On |
| Discord Token | High | On |

### Crypto & web3

Wallet keys, seed phrases and addresses. Irreversible if exposed — there is no chargeback.

| Type | Risk | Default |
| --- | --- | --- |
| BIP-39 Seed Phrase | High | On |
| Wallet Private Key (WIF) | High | On |
| Extended Public Key (xpub) | Mid | On |
| Lightning Invoice (BOLT-11) | Low | On |
| Bitcoin Address | Mid | On |
| Ethereum Address | Mid | On |
| Ripple Address | Mid | On |
| Solana Address | Mid | On |
| Monero Address | Low | On |
| Transaction ID | Low | On |

### Legal & business

Case, contract and filing identifiers. Often confidential by court order or agreement.

| Type | Risk | Default |
| --- | --- | --- |
| Legal Case Number | High | On |
| Court Order Number | High | On |
| Litigation ID | High | On |
| Subpoena Number | High | On |
| Deposition ID | High | On |
| Evidence ID | High | On |
| Witness ID | High | On |
| Filing Number | High | On |
| Settlement Reference | High | On |
| Contract Number | Mid | On |
| Organization Name | Mid | On |
| State Bar Number | Low | On |
| Patent Number | Low | On |
| Trademark Number | Low | On |
| Entity Number | Low | On |

### Device & network

Identifiers that pin activity to a specific machine or connection.

| Type | Risk | Default |
| --- | --- | --- |
| IMEI | Mid | On |
| ICCID (SIM Card) | Mid | On |
| IP Address | Mid | On |
| IPv6 Address | Mid | On |
| MAC Address | Mid | On |
| Android ID | Mid | On |
| iPhone UDID | Mid | On |
| UUID | Low | On |
| Serial Number | Low | On |

## When the catalog isn't enough

No built-in list can know your matter codes, your project codenames, or the client shorthand your team uses in every message. Those are [custom rules](https://sonomos.ai/support/locke/controls/): give Locke a pattern or a list of terms, decide whether to mask or just flag matches, and test it in the [Sandbox](https://sonomos.ai/support/locke/sandbox/) before you rely on it. Teams admins can push custom rules to everyone at once — see [My Team](https://sonomos.ai/support/locke/team/).