customer_tax_number Field Masking

Overview

Spreedly returns customer_tax_number — a customer's national tax or identification number (for example, a Brazilian CPF) — in customer_data, and its gateway-specific equivalent inside gateway_specific_fields, on transaction API responses and webhook callbacks for some endpoints. This field is regulated personal data under LGPD and similar data protection laws, and Spreedly now masks it in these responses as part of an ongoing effort to minimize sensitive data exposed through our API.

What's changing

Starting January 21, 2027, Spreedly masks the following in transaction API responses (JSON and XML) and webhook callbacks, rather than returning it in full:

• customer_data.customer_tax_number
• The equivalent gateway-specific field inside gateway_specific_fields / gateway_specific_response_fields, for the following gateways:
  • Checkout.com
  • CommerceHub
  • dLocal
  • Ebanx
  • Kushki
  • Mercado Pago
  • Mundipagg
  • Payeezy
  • PayTrace
  • PayU LATAM
  • Worldpay

At most the last 4 characters of the value remain visible, and the rest is replaced with * so the original length is preserved (for example, 12345678901 appears as ******8901). Values of 4 characters or fewer are fully masked. This is consistent with how Spreedly already masks other sensitive identifiers elsewhere in the API. This field continues to be used normally when processing your transaction. Only its appearance in the API response has changed. All other fields in your transaction responses are unaffected.

What you need to do

If your integration reads, logs, or stores the full customer_tax_number value (or a gateway-specific equivalent) from a Spreedly transaction response, update your integration to expect a masked value instead. The field will remain present under the same key; only its value changes.

If you send this value as a number rather than a string, it is returned as a masked string, so make sure your integration can handle a string value.

If you are not currently using this response field, no action is needed.

If you have questions about this change, contact [email protected] or your Spreedly account manager.