# Pseudonymization policy

Pseudonymization reduces re-identification risk; it is not anonymization. Before any project-derived material is exported outside its trusted project boundary, the export adapter must remove or replace:

- Git names, emails, repository remotes, and organization identifiers;
- absolute paths, usernames embedded in paths, hostnames, and device names;
- environment-variable values and credential-like values;
- personal or team email addresses;
- public and private IP addresses;
- client identifiers explicitly registered for the project.

Stable correlation identifiers, when required, must use an installation-scoped keyed digest whose key is stored outside project repositories. Raw identifiers must never be used as an unhashed input exposed in logs or manifests.

Pseudonymization must run after secret redaction and before serialization, notification, issue reporting, learning promotion, or cross-project export. The output must be scanned again after transformation. If a required pseudonymization adapter or key is unavailable, the export fails closed.

The context manifest may record categories and counts of replaced values, but never the original values or reversible mappings.