Anonymizing email threads without breaking them

Email is one of the most useful kinds of company data and one of the hardest to anonymize well. A single thread can carry the same person's identity in a dozen places at once, and a careless pass either misses some of them or strips out so much that the conversation no longer makes sense. The goal is to do neither.

In a chat tool, each message usually has one author, one timestamp and a short body. Identity mostly lives in the author field and in mentions.

Email is layered. Every reply can carry the full history of the thread beneath it, sometimes reformatted by a different mail client. Forwards bring in whole conversations from other people and other companies. Signatures repeat names, titles, phone numbers and addresses on every message. Attachments add documents, spreadsheets and scanned PDFs, each with identifiers of their own.

So a thread of ten messages might contain the same customer contact's name forty times, in five different formats. Missing one of them is enough to undo the rest.

A thorough pass has to look in all of the places a name, address or number can appear, not just the obvious ones:

• Headers: From, To, Cc and Reply-To, including display names that differ from the address
• Greetings and sign-offs: "Hi Jen," "Thanks, Mo," and initials at the bottom of a quick reply
• Signatures: full names, titles, direct lines, mobile numbers, office addresses and links to personal profiles
• Quoted replies: the "On Tuesday, so-and-so wrote" line and everything quoted below it
• Forwarded blocks: embedded headers from earlier messages, often from people outside the company
• Body text: names, email addresses, phone numbers, account references and street addresses written inline
• Attachments: contracts, invoices and scans with names, signatures, logos and sometimes ID numbers

Each of these is replaced with a consistent token, removed outright or blacked out, depending on what it is. Credentials, API keys, card numbers and government IDs are removed. Faces, logos and signatures in images and PDFs are blacked out.

The other half of the job is preserving what makes a thread useful. An email thread is valuable because it shows a sequence: who raised the problem, who responded, who was brought in, what was promised and what happened next.

That only survives if each person keeps one token throughout. If the customer is PERSON_207 in the From header, she has to be PERSON_207 in the quoted reply line, in the greeting ("Hi PERSON_207"), in the forwarded block and in the Cc list of the next message. Her company has to be the same company token in her signature and in the body of an internal reply that mentions it. We explain why this matters across every tool, not just email, in why the same person must get the same token everywhere.

Structure matters too. Reply order, timestamps, subject lines (with identifiers tokenized) and the link between a message and its replies are kept, so a model can follow the conversation the way a person would. Duplicate quoted text is handled carefully, since it is often the same content seen from a different point in the thread.

Much of a company's email is with people outside it: customers, vendors, auditors, lawyers, recruiters and partners. These people did not work at the seller, which is one reason they get the same treatment as employees. Every external person becomes a token, and every external company becomes a company token, consistent across email, CRM, support and chat.

Sellers can also exclude specific clients entirely. If a customer's contract has a confidentiality clause, or the relationship is simply sensitive, those threads can be listed as out of scope and annexed to the contract before any data moves. Our post on customer confidentiality clauses covers how to think about this.

Attachments need their own pass. A signed contract might have a signature block, a company logo and a notary stamp. An invoice might have a bank account and a tax ID. A scanned onboarding form might have a photo. Text identifiers are tokenized or removed, and visual ones are blacked out, using the approach described in faces, logos and signatures.

Some email should not be in a training dataset at all, however well it is anonymized. HR, payroll, medical and legally privileged material is excluded by default, which in email terms means threads with outside counsel, internal legal discussions, employee relations matters and benefits or health correspondence. Personal mailboxes and one-to-one private messages are treated like DMs in chat: excluded unless the company chooses to include them and has the right to.

All of this happens in-house. No third party touches the raw mailboxes, and the raw archive is deleted within 30 days of sign-off, as a contract obligation, with a deletion certificate.

Before delivery, the seller reviews an anonymized sample, and email is a good place to look closely. Open a long thread with a customer you know. Check that the same person has the same token in the header, the greeting and the quoted text. Look at signatures and forwarded blocks, which are where leaks most often hide. Open an attachment or two. If something looks wrong, it is fixed before anything moves.

If your company has years of email alongside chat, tickets or code, it is likely to be among the most valuable parts of the record. Book a 15-minute call to find out what it could be worth.