Subscriber data stays masked by default.

Investigation does not require plaintext. Matching runs on blind indexes; exposure is deliberate, approved, logged and time-bound.