Customer records in your CRM are often accessible across multiple teams, but not every team needs access to every field. For example, a non sales team may not need to see a contact’s mobile number, while a support agent verifying a caller’s identity may only need to see the last few digits.

With Field Masking, you can protect sensitive information by displaying the entire value as asterisks or showing only a portion of the value, such as 9******8621. This gives you granular control over who can view sensitive data in Zoho CRM and how that data is handled when it leaves the CRM.

Key Benefits of Field Masking

• Full or partial masking: Completely hide field values or partially mask them, such as displaying only the last few digits of a phone number or email address.
• Profile based access to unmasked data: Choose which system defined or custom profiles can view the original, unmasked value. This allows you to provide access only to users who need it.
• Control over data shared outside CRM: When exporting data or sharing it through integrations and APIs, you can determine whether masked fields are shared as masked, unmasked, or restricted entirely.
• Uninterrupted workflows: Masking does not prevent users from performing day to day tasks. For example, users can still place a call by clicking the call icon even when the phone number is masked.
• Template level control: In email and other templates, you can control whether masked fields appear in their masked or unmasked form.
• Report level control: When viewing or sharing reports, you can determine whether masked field values are displayed as masked or unmasked.
  

Use Case

Consider a typical support call where an agent needs to verify a caller’s identity without having access to the complete phone number or policy ID.

With Field Masking:

• Sensitive fields such as phone numbers, account numbers, or policy IDs can be masked by default.
• Agents can see only partial values, such as the last four digits.
• The agent can ask, “Can you confirm the last four digits of your registered number?” and complete the verification process without accessing the full number.
• Even when the phone number is masked, the agent can still place a call directly by clicking the phone icon next to the field.

This provides a balance between security and usability, ensuring sensitive information remains protected without disrupting day to day operations.

Field Masking can also be used to protect sensitive information such as Phone numbers, Social Security numbers, email addresses, policy numbers, account numbers, and other confidential information. It can be applied to both system defined and custom fields, giving you flexibility over which data should be protected.

Enabling Field Masking

Field Masking is enabled in two stages. First, you enable the feature and configure how masked data should behave when it leaves CRM. Next, you select the individual fields that should be masked.

Step 1: Enable Field Masking and Configure Data Sharing Preferences

After Field Masking is enabled, you can configure how masked fields behave when data leaves Zoho CRM through integrations, APIs, or exports.

Note: Field Masking can also be enabled directly from the field properties, providing an alternative way to enable the feature.

Points to Consider Before Enabling Field Masking

Once Field Masking is enabled, applicable data will be masked within Zoho CRM. However, when data leaves CRM through an integration, API call, or export, you can control how masked fields are handled at that point.

The following options are available:

• Without Masking: The original value is shared as is. This is suitable when the receiving system or user is trusted and requires access to the complete information.
• Based on User’s Masking Permission: The value shared depends on the user’s masking permissions within CRM. If a user cannot view the unmasked phone number in CRM, they will not receive the unmasked value through an export or API response either.
• Restrict Masked Fields: The field is excluded entirely from the transfer. This is useful when sensitive information should not leave CRM.
• With Masking: The masked value, such as 98******21, is shared instead of the original value. This option is available for APIs and exports and is useful when users need to reference records without accessing the underlying sensitive information.
  

Note: The ability to configure exceptions to these preferences for individual fields is planned for future updates.

Step 2: Configure Individual Fields

Once Field Masking is enabled, individual fields can be configured for full or partial masking. You can also specify which profiles have permission to view the original, unmasked value.

When editing the properties of a field in the module layout, two masking types are available:

• Full Masking: The entire field value is hidden, such as ********.
• Custom Masking: You can choose to mask only a portion of the field value, such as the first few characters or the last few characters.
  

While configuring Field Masking, you can specify which users or profiles can view the actual unmasked data. Both system defined and custom profiles are available for selection.

Viewing Unmasked Data

For users who have permission to view unmasked data:

• An eye icon (👁️) is displayed next to the masked field.
• Clicking the eye icon reveals the actual value.
  

• Users can place a call directly from a masked phone number even if they do not have permission to view the complete number.
  

List Views

In list views, users can unmask the data using the hamburger menu available in the column header, provided they have the required permissions.

Templates

In templates, the Mail Data with Masking preference allows you to control how merge field data is shared when emails are sent using the template.

This preference applies to all masked fields, regardless of the user’s profile permissions.

Reports

When viewing or sharing reports, you can choose whether masked field values should appear in their masked or unmasked form.

Supported Field Types

Field Masking can be applied to the following field types:

• Single Line
• Email
• Phone
• Date
• Date/Time
• Number
• Currency
• Decimal
• Long Integer
• URL

Note: Custom Masking is supported for Single Line, Email, and Phone fields.

Areas Where Field Masking Is Not Yet Implemented

The following areas currently have limitations where Field Masking is not supported:

• Email Views: Emails Related List, Conversation View, SalesInbox, Mail Magnet, Email Reports, Mass Mail Delivery Stats, and record preview in the composer.
• Calls: If the From or To field in the Calls module is masked but the number is not associated with a record, the number will be visible when the call is placed.
• Signal notifications
• Zia features involving data transfer
• Mobile App

Note: Once Field Masking is enabled for your organization, the phone number will not be displayed in the call subject in the Calls module, regardless of whether Field Masking is enabled for that specific field.

Feature Availability

Supported Editions: Enterprise and Ultimate editions of Zoho CRM.

Limits:

• Enterprise: Up to 10 masked fields per module.
• Ultimate: Up to 20 masked fields per module.

Note: Field Masking is available across all modules except the Users module.