Sometimes, you do want the activity to log ("we know an email was exchanged on this date between these people") but we don't want to log the content.
For this use case, you can use content redaction (note: this requires our AppExchange product)
The data workflow for content redaction is as follows:
Our email tracking services makes a 'Create Task' command to Salesforce
Truly's AppExchange app is invoked on the INSERT command before that Task is committed to the Salesforce database
Based on any whitelisting logic that you may want to use (eg: reference to a blacklist field on the Account/Contact), you can use a Tracker to update the record to remove any sensitive information, as well as make a note that the contact has been redacted.
The INSERT transaction is completed with the sensitive data removed.
Because Truly trackers support Regular Expressions, you can search for any pattern imaginable to identify things like Credit Card numbers or Personal Identifiable Information.