Sensitive fields

When a visitor submits a lead form, Jellyhook stores what they entered so you can see the lead. Some values should never be stored by a lead tool at all: payment cards, bank accounts and identity numbers. Jellyhook leaves those out automatically, in the visitor's browser, before anything is sent. You can leave out any other field yourself with one attribute.

When this matters

A consultancy's enquiry form also takes a deposit: it has a card number and a security code below the message box. With Jellyhook installed, the lead arrives with the name, email, company and message. The card details never leave the visitor's browser, so they are not in your Jellyhook data, not in exports and not in anything an AI app connected to your account can read.

What is never stored

Payment cardsCard number, security code (CVV, CVC, CSC), expiry date. Also any value that is a valid card number, whatever the field is called.

Bank accountsIBAN, BIC or SWIFT code, routing number, sort code, account number.

Identity and tax numbersSocial security number, national insurance number, national id, passport number, tax id (TIN, ITIN, EIN). Also any value written like a US social security number (123-45-6789).

SecretsPasswords and PINs.

How a field is recognised

A field is left out when any one of these is true:

The field says it is a card fieldIts autocomplete attribute starts with cc- (cc-number, cc-csc, cc-exp). Browsers and payment forms set this.

Its name or label says soThe field's name, id, placeholder, accessible label or visible label is one of the words above, for example card_number, Card Number, cvv, IBAN, Social Security Number, passport_no, tax_id.

The value looks like one13 to 19 digits that pass the checksum every payment card uses, or the pattern 123-45-6789. Phone fields are never checked this way, because a long phone number can pass the checksum by chance.

The site owner says soThe field, or an element around it inside the form, carries data-jh-ignore.

The same rules run again on Jellyhook's servers when a submission arrives, so a value is still removed if an old copy of the script is cached in a visitor's browser. HubSpot forms follow the same rules, using the field names HubSpot reports.

data-jh-ignore: leave out any other field

For anything the rules above cannot know about, such as a medical question, an internal reference or a free-text box you would rather not keep, add data-jh-ignore to the field or to an element around it inside the form.

<form data-conversion="true">
  <input name="email">
  <input name="name">
  <div data-jh-ignore>
    <label>Describe your symptoms</label>
    <textarea name="symptoms"></textarea>
  </div>
</form>

An ignored field is left out of everything: its value, its timing, the form's field list and validation errors. It is also not used to find the lead's name, email or phone, so do not put it on those fields. On the form element itself, it leaves out every field: only the fact that the form was submitted is recorded.

What is still recorded for a sensitive field

A field recognised by the rules (not one marked data-jh-ignore) still appears in form engagement with its timing: when it was clicked into and how long the visitor spent in it. This shows, for example, that people stop at the card number. Its value is never recorded, there or anywhere else. To leave out the timing too, use data-jh-ignore.

Limits

Recognition works from names, labels and value patterns. A sensitive field with a meaningless name and no label (for example "field_12") whose value does not look like a card or social security number cannot be recognised: mark it with data-jh-ignore. Card fields inside a payment provider's own frame (Stripe, PayPal and similar) are never visible to Jellyhook at all. Submissions stored before 14 October 2026 were not filtered this way.

Tracking attributes, Form engagement, Privacy and consent.