> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corsa.finance/llms.txt
> Use this file to discover all available pages before exploring further.

# Features lost with HYOK

> What changes for HYOK-encrypted fields: exact-match search and sanctions screening only, no AI on encrypted values, encrypted exports, and which fields are eligible.

Corsa can't read HYOK-encrypted values, so any feature that needs the plaintext doesn't work on those fields. Features on fields you don't encrypt are unaffected. This page lists every difference so you can choose your fields with full information.

***

## Feature comparison

| Feature | Corsa-managed and BYOK | HYOK-encrypted fields |
| - | - | - |
| View values in the app | ✓ | ✓ Through the Secure Viewer, after passkey sign-in, for `hyok-decryptors` members only |
| Exact search, find by email or ID | ✓ | ✓ Exact match on the normalized value, through the keyed index |
| Fuzzy, partial, or prefix search | ✓ | ✗ |
| Sorting and grouping by the field | ✓ | ✗ |
| Duplicate detection | ✓ Fuzzy and exact | Exact match only |
| **Sanctions and PEP screening on names** | ✓ Fuzzy matching | **Exact-match only.** See [Screening on encrypted names](#screening-on-encrypted-names) |
| Rules, workflow triggers and filters on the field | ✓ All conditions | ✗ Rules and triggers see the encrypted value, so conditions on these fields never match. Don't encrypt fields your rules or triggers depend on |
| Field values in emails, messages and workflow templates | ✓ | ✗ Templates receive the encrypted value, not the plaintext |
| AI features (Copilot, Alert Agents, Investigation Agent, DD Agent) | ✓ | ✗ AI sees no plaintext for these fields. Answers and summaries can't use them |
| Exports and reports | ✓ Plaintext | Encrypted values only. Decrypt in the Secure Viewer |
| Webhook payloads | ✓ Plaintext | Encrypted values only |
| Corsa KYC integrations | ✓ | ✓ Values are encrypted on arrival. See the [trust model](/hyok/index#trust-model) |
| Corsa support viewing the value | ✓ | ✗ Share it through your own channel if needed |

***

## Screening on encrypted names

When name fields are HYOK-encrypted, Corsa screens them with **exact-hash matching**:

1. For your workspace, Corsa normalizes every primary name and alias on the screening list and computes its keyed index with your workspace's salt. It recomputes these indexes whenever the list is updated.
2. Corsa compares them with the stored keyed index of the client's name.
3. A client matches when their complete normalized name equals a list name or alias:
   * full name (for example a company's legal name);
   * first, middle, and last name together, in given-name-first or family-name-first order;
   * first and last name, when the list entry has no middle name.

Normalization ignores case, accents, punctuation, and extra spaces. `José María García-López` and `JOSE MARIA GARCIA LOPEZ` match.

Exact-hash matching **doesn't** find:

* transliteration variants (`Mohammed` vs `Muhammad`);
* typos and spelling variants;
* partial names, initials, or a first or last name on its own;
* nicknames that aren't listed aliases.

Matches have a confidence score of 1 and are labeled **exact-hash match** in the alert. Date of birth, nationality, and other attributes don't affect exact-hash matches. Fuzzy screening is shown as unavailable for the encrypted name fields.

<Warning>
  Exact-match screening has a higher false-negative rate than fuzzy screening. Discuss compensating controls with your compliance team. For example, keep names unencrypted and encrypt only identifiers and contact details, choose [BYOK](/encryption/byok) instead, or screen names in your own systems before ingest.
</Warning>

***

## Eligible fields

You can encrypt these fields with HYOK:

| Group | Individual clients | Corporate clients |
| - | - | - |
| Names | `general.firstName`, `general.middleName`, `general.lastName` | `general.legalEntityName` |
| Government ID and document numbers | `general.personalId` | — |
| Contact details | `contact.emailAddress`, `contact.phoneNumber`, `address.addressLine1`, `address.addressLine2`, `address.city`, `address.postalCode` | `contact.emailAddress`, business and registration address lines, city, postal code |

Corsa rejects any other field for HYOK with HTTP `400`. It also rejects an eligible field when a rule or workflow trigger uses it in a non-equality condition. Change the rule first, or keep the field unencrypted.

### How values are normalized for search

Exact search and screening compare normalized values, so formatting differences don't matter:

| Field kind | Normalization | Example |
| - | - | - |
| Names | Remove accents, lowercase, replace punctuation with spaces, collapse spaces | `O'Brien, Seán` → `o brien sean` |
| Email | Trim, lowercase | ` Jane.Doe@Example.COM` → `jane.doe@example.com` |
| Phone | Digits only, keep a leading `+` (a leading `00` becomes `+`) | `0044 20 7946 0000` → `+442079460000` |
| ID numbers | Uppercase, remove spaces, `-`, `.`, `/` | `ab-123.456/7` → `AB1234567` |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.