transform redact_pii {
  fields_to_hash: [customer_email, customer_email_secondary]
  fields_to_mask: [phone, ssn]
  hash_algo: sha256
  mask_char: "•"
  preserve_length: true

  on_missing: skip
  on_error:   route_to_dlq

  output {
    customer_email_hash = sha256(input.customer_email)
    phone               = mask(input.phone, keep_last=4)
    ssn                 = mask(input.ssn, keep_last=0)
    _redacted_at        = now()
  }
}