Building a Real-Time PII Catalog for Keycloak

User data was in motion, and you didn’t know where it was going.

Keycloak holds identities, and with them, personally identifiable information. A Keycloak PII catalog gives you a complete map of that data—what exists, where it lives, and how it moves. Without a catalog, sensitive attributes can hide in tokens, claims, and custom attributes, exposing you to risk and compliance failures.

A Keycloak PII catalog works by scanning realms, clients, and user attributes. It identifies fields like names, emails, phone numbers, addresses, and any custom attribute carrying personal data. It connects each data point to its source and destination. You see exactly which APIs, identity providers, and applications process each category of PII.

Centralizing this view turns audits from guesswork into certainty. GDPR, CCPA, and internal security reviews become straightforward. You can trace when a given piece of PII was created, transformed, or deleted. You also gain visibility into shadow integrations—systems consuming PII that were never documented.

Keycloak’s data model makes automated cataloging possible. API-driven discovery collects schema details from realms and federated identity sources. It matches keys and values against common PII patterns. Then it compiles a searchable, filterable data inventory you can query at will.

A live PII catalog means you know your exposure in real time. When a new custom user attribute appears, you see it. When an integration begins storing birth dates in tokens, you see it. When offboarding a client application, you confirm all related PII is deleted.

Security teams avoid blind spots. Engineers can prevent sensitive fields from leaking into logs. Product managers can document every PII touchpoint before launching features. All of it starts with having the actual, current map of your Keycloak data.

You can maintain this visibility manually with scripts and exports. Or you can make it instant and ongoing. Hoop.dev integrates directly with Keycloak to build and update your PII catalog automatically. See every field, every flow, and every connection—live in minutes.