diff --git a/sanitize.config.json b/sanitize.config.json
index 580af1b..63c9c4a 100644
--- a/sanitize.config.json
+++ b/sanitize.config.json
@@ -21,7 +21,8 @@
       "a specific dataset accession ID, file path, or repository tied to one private/in-progress study (e.g. an embargoed OpenNeuro dataset)",
       "names of collaborators, PIs, reviewers, or institutions tied to one active engagement (not public co-author lists)",
       "grant numbers, IRB/ethics protocol numbers, or funding details specific to one engagement",
-      "a codename or label that identifies one particular study (e.g. used as a skill name or heading)"
+      "a codename or label that identifies one particular study (e.g. used as a skill name or heading)",
+      "a messaging or account identifier tied to a real person — a Signal/Telegram UUID, a contact phone, an allowlisted user ID (these belong in deployment config/secrets, never in the package)"
     ],
     "do_not_flag_examples": [
       "generic methodology (\"how to verify a citation\", \"how to grade a source\")",
diff --git a/scripts/check_sanitization.py b/scripts/check_sanitization.py
index 55213fc..ab33baa 100644
--- a/scripts/check_sanitization.py
+++ b/scripts/check_sanitization.py
@@ -59,6 +59,9 @@ def load_config(root="."):
     ("private-key-block", re.compile(r"-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----")),
     ("email", re.compile(r"\b[A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,}\b")),
     ("us-phone", re.compile(r"(?<!\d)(?:\+?1[\s.\-]?)?\(?\d{3}\)?[\s.\-]\d{3}[\s.\-]\d{4}(?!\d)")),
+    # E.164 international (e.g. a contact wired into config/SOUL): "+" + 7–15 digits,
+    # no separators. The us-phone pattern only covers North-American formatting.
+    ("intl-phone", re.compile(r"(?<!\d)\+\d{7,15}(?!\d)")),
     ("ipv4", re.compile(r"(?<!\d)(?:\d{1,3}\.){3}\d{1,3}(?!\d)")),
 ]
 
diff --git a/tests/test_check_sanitization.py b/tests/test_check_sanitization.py
index 60ad929..7562edb 100644
--- a/tests/test_check_sanitization.py
+++ b/tests/test_check_sanitization.py
@@ -31,6 +31,14 @@ def test_detects_ipv4_but_allows_loopback():
     assert not any(l == "ipv4" for l, _ in cs.scan_deterministic("bind 127.0.0.1", ["127.0.0.1"]))
 
 
+def test_detects_international_phone():
+    # E.164 form with no separators — the us-phone pattern misses these entirely.
+    assert any(l == "intl-phone" for l, _ in cs.scan_deterministic("contact +442079460958 anytime", []))
+    assert any(l == "intl-phone" for l, _ in cs.scan_deterministic("MATILDE_CONTACT=+4915123456789", []))
+    # Not a phone: a short +N token (version, diff count) must not trip it.
+    assert not any(l == "intl-phone" for l, _ in cs.scan_deterministic("rebased +1234 ahead", []))
+
+
 def test_generic_methodology_is_clean():
     assert cs.scan_deterministic("Structure a handoff: decisions, threads, next step.", []) == []