> ## Documentation Index
> Fetch the complete documentation index at: https://docs.meetdoris.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Privacy Modes

> Control how personally identifiable information is handled across the Ontology API and MCP server

## Overview

Every ontology query — whether via the REST API or MCP server — supports three privacy levels that control how personally identifiable information (PII) appears in responses. Privacy filtering happens server-side before data leaves Doris, so external tools and LLMs never see unmasked data unless you explicitly request it.

## Privacy Levels

<Tabs>
  <Tab title="Full">
    No masking. All PII fields are returned as stored.

    **Use for:** Internal analysis, your own dashboards, CRM sync.

    **Available via:** REST API (`?privacy=full`, the default)

    ```json theme={null}
    {
      "full_name": "Adam Cross",
      "email": "adam.cross@minesoft.com",
      "phone": "+44 7700 900123",
      "linkedin_url": "https://linkedin.com/in/adamcross"
    }
    ```
  </Tab>

  <Tab title="Masked">
    Names are initialed, emails show first character and domain, phones keep the last 4 digits, LinkedIn URLs are omitted. Your own team's deal-owner fields are preserved.

    **Use for:** AI assistants, external LLM tools, any context where data passes through a third-party model.

    **Available via:** MCP (automatic, always on), REST API (`?privacy=masked`)

    ```json theme={null}
    {
      "full_name": "Adam C.",
      "email": "a***@minesoft.com",
      "phone": "+44 *** *** 0123",
      "linkedin_url": null
    }
    ```
  </Tab>

  <Tab title="Anonymous">
    All identity is removed. Stakeholders become role-based identifiers like "Champion #1" or "Evaluator #2". Email expansions are omitted entirely. Person search results appear as "Contact #1", "Contact #2", etc.

    **Use for:** Customer-facing exports, shared reports, anywhere real identities must not appear.

    **Available via:** REST API (`?privacy=anonymous`)

    ```json theme={null}
    {
      "title": "Champion #1",
      "email": null,
      "phone": null,
      "linkedin_url": null
    }
    ```
  </Tab>
</Tabs>

## Field Reference

This table shows exactly how each PII field is transformed at each privacy level.

| Field          | Full                                                      | Masked                 | Anonymous                 |
| -------------- | --------------------------------------------------------- | ---------------------- | ------------------------- |
| `full_name`    | Adam Cross                                                | Adam C.                | Omitted (role ID instead) |
| `email`        | [adam.cross@minesoft.com](mailto:adam.cross@minesoft.com) | a\*\*\*@minesoft.com   | Omitted                   |
| `phone`        | +44 7700 900123                                           | +44 \*\*\* \*\*\* 0123 | Omitted                   |
| `linkedin_url` | Included                                                  | Omitted                | Omitted                   |
| `owner_name`   | Included                                                  | **Preserved**          | Omitted                   |
| `owner_email`  | Included                                                  | **Preserved**          | Omitted                   |
| `sender`       | Included                                                  | First name + initials  | Omitted                   |
| `sender_email` | Included                                                  | a\*\*\*@domain.com     | Omitted                   |

<Note>
  **Deal owner preservation:** In masked mode, `owner_name` and `owner_email` on deals are not masked — these are your own team members, and you need to see who owns a deal. In anonymous mode, all identity fields are omitted.
</Note>

## REST API Usage

Add the `?privacy=` query parameter to any ontology endpoint. The default is `full`.

```bash theme={null}
# Masked — safe for external tools
curl "https://server.meetdoris.com/api/v1/ontology/deal/{id}?privacy=masked&expand=stakeholders" \
  -H "Authorization: Bearer $TOKEN"

# Anonymous — safe for customer-facing exports
curl "https://server.meetdoris.com/api/v1/ontology/search?q=pricing&privacy=anonymous" \
  -H "Authorization: Bearer $TOKEN"
```

The `privacy` parameter is supported on all five query endpoints:

| Endpoint                             | Default |
| ------------------------------------ | ------- |
| `GET /search`                        | `full`  |
| `GET /{type_name}`                   | `full`  |
| `GET /{type_name}/{object_id}`       | `full`  |
| `GET /batch`                         | `full`  |
| `GET /{type_name}/{object_id}/links` | `full`  |

## MCP Server

The MCP server enforces **masked** mode on all connections. This is set server-side and cannot be overridden per-request — every tool call (`ontology_resolve`, `ontology_list`, `ontology_search`, `ontology_batch`, `ontology_traverse`) automatically masks PII before returning results to your AI tool.

This means you can safely connect Claude, ChatGPT, Cursor, or any MCP-compatible tool without worrying about PII leaking to external LLM providers.

If you need full or anonymous access, use the REST API directly.

## Expand Keys and Privacy

Privacy filtering applies to expanded data too:

* **Stakeholders** — PII fields within each stakeholder record are masked or anonymized. In anonymous mode, stakeholder names are replaced with role-based IDs (Champion #1, Evaluator #2, etc.).
* **Emails** — Sender names and addresses are masked. In anonymous mode, the entire `emails` expansion is omitted from the response.
* **Non-PII expansions** — Commitments, objections, competitors, strategy, meetings, and all other expand keys pass through unchanged at every privacy level.

## Demo Sandbox

The [demo sandbox](/sandbox) uses synthetic data for a fictional company (Meridian Technologies). Since no real PII exists, all sandbox responses return full data regardless of privacy settings.