What the engine does not detect
Published 2026-08-23. Engine build is identified by hash and ruleset version
(GET https://api.cloakapi.io/api/v1/engine/hashes). Coverage is a property of the
bytes on the device, not of this HTML.
PII types and identification modes the engine does not catch
These are types and modes, not just evasion tricks. Each row is grounded in Detection coverage § «Not mitigated» or in an explicit out-of-scope statement there.
| Type / mode | Why it is not caught | Source |
|---|---|---|
Homoglyph identifiers (Cyrillic о for Latin o in an email, and similar) | No Unicode confusable folding (UAX #39). Pattern rules see a different code point. | Detection coverage, Not mitigated |
| PII inside general encodings (arbitrary base64 of an email, hex dumps, quoted-printable bodies) | Only checksum-gated payment-card base64 is decoded. Other encodings pass as opaque tokens. | Detection coverage, Not mitigated |
| Fragmented non-email identifiers (national ID split across a line-wrap, page boundary, or markup) | OCR/line-wrap repair is scoped to email-shaped runs. Other classes are matched on the text as the device sees it. | Detection coverage, Not mitigated |
| Bare, uncued digit runs (an undelimited digit string with no cue word, no country prefix, no checksum) | Deliberately not treated as a phone number or national ID — false positives on order numbers. | Detection coverage, Not mitigated |
| Names and places outside the gazetteer + ten-language model | Gazetteer is finite. Optional NER covers ar, de, en, es, fr, it, lv, nl, pt, zh. Rare names, unlabelled single-token brands, thinner scripts, ALL-CAPS / all-lowercase names the gazetteer does not hold. | Detection coverage, Not mitigated |
| Semantic identification without an identifier («the patient in bed 7», «the employee who resigned last Tuesday») | No identifier present. Out of scope; no receipt claims it. | Detection coverage, Not mitigated |
| Server-side detection of anything | There is no /v1/detect or server-side detector. If a client sends plaintext, the gateway does not catch it on our servers (Level-1). | Detection coverage, Where detection runs |
What this page is not
- It is not a claim that these types are safe to send. They are holes. Tokenise on the device; do not rely on the gateway to notice.
- It is not a precision/recall figure. Measured numbers stay on Detection benchmark.
- It is not the evasion list restated as marketing. Homoglyphs and encodings are types of missed PII, listed so a customer can see the negative catalogue next to the positive one.
Change control
A type moves off this page only when the shipped engine catches it, the coverage page is updated, and this list is re-issued with a new last_reviewed date. Adding a bullet without an engine change would be a published falsehood.