Skip to main content

Overview

RDK can automatically redact Personally Identifiable Information (PII) from your traces before they’re sent to the collector. This helps you maintain compliance while still getting valuable observability data.

Quick Start

Enable built-in redaction

Pass redact_pii=True to init() to enable default PII redaction:

Custom redaction

For fine-grained control, build a redactor with RedactorConfig:

Built-in Patterns

RedactorConfig Fields

boolean
default:true
Redact email addresses.
boolean
default:true
Redact phone numbers (formats: 555-123-4567, 555.123.4567, 5551234567).
boolean
default:true
Redact US Social Security Numbers (123-45-6789).
boolean
default:true
Redact 16-digit credit card numbers.
boolean
default:true
Redact API keys matching common patterns (sk-, api_key, bearer ...).
list[tuple[re.Pattern, str]]
default:"[]"
List of (compiled_pattern, replacement_string) tuples applied after built-in patterns.
Callable[[str], str]
default:"None"
A function applied to each string value before the built-in patterns. Use for custom logic that regex can’t express.

Utility Functions

redact_all_pii(value) — One-shot redaction using all default patterns. Useful for sanitizing data outside of traces.
create_default_redactor() — Returns a reusable redactor with all defaults enabled.

What Gets Redacted

Redaction is applied to:
  • Span inputs — messages sent to the LLM
  • Span outputs — responses from the LLM
  • Tool arguments and results
Redaction is not applied to:
  • Trace/span IDs
  • Timestamps
  • Token counts
  • Model names
  • Metadata keys (only values are scanned)

Best Practices

  1. Always enable PII redaction in production
  2. Test custom patterns against realistic sample data before deploying
  3. Use custom_redactor for preprocessing (e.g., tokenization) before regex matching

See Also