Upcoming: customer_tax_number masked in transaction API responses on Jan 21, 2027
October 22nd, 2026
Starting January 21, 2027, Spreedly will mask customer_tax_number and its gateway-specific equivalents in transaction API responses and webhook callbacks, showing only the last 4 characters (for example, 12345678901 appears as *******8901). This applies to Ebanx, dLocal, PayU LATAM, Mundipagg, Mercado Pago, Checkout.com, Kushki, PayTrace, CommerceHub, Worldpay, and Payeezy. This field carries regulated personal data under LGPD and similar laws.
If your integration reads, logs, or stores the full value, update it to handle a masked value before January 21, 2027. See the customer_tax_number field masking announcement for details.