Privacy, Masking and Data Retention

Traces are a sensitive data store

Traces store the full text users typed and the model returned, so they collect names, phone numbers, addresses, health or financial details, and sometimes API keys pasted by mistake. That makes your observability backend a sensitive database, subject to privacy laws such as India's Digital Personal Data Protection Act and the GDPR for European users. Apply four habits. Minimise: do not capture what you do not need; disable input or output capture for functions that handle documents or credentials. Mask: run a masking function in the SDK before data leaves your process; Langfuse accepts a mask function when the client is created, and LangSmith supports hiding inputs and outputs and custom anonymisers. Restrict access: limit who can view production traces. Retain briefly: configure retention so old traces are deleted. Regex masking catches obvious patterns, but not everything, so combine it with minimisation.

Where to protect trace data

Data should be minimised in code, masked inside the SDK, access-controlled in the backend, and deleted by a retention policy.

A masking function

Masks emails and Indian mobile numbers recursively in nested data. With Langfuse you would pass it as Langfuse(mask=mask).

import re

EMAIL = re.compile(r"[\w.+-]+@[\w-]+\.[\w.]+")
PHONE = re.compile(r"(?:\+91[\s-]?)?[6-9]\d{9}\b")

def mask(data, **kwargs):
    if isinstance(data, str):
        return PHONE.sub("[PHONE]", EMAIL.sub("[EMAIL]", data))
    if isinstance(data, dict):
        return {k: mask(v) for k, v in data.items()}
    if isinstance(data, list):
        return [mask(v) for v in data]
    return data

print(mask({"question": "Mail riya.s@example.com or call +91 9876543210", "top_k": 3}))

Output:

{'question': 'Mail [EMAIL] or call [PHONE]', 'top_k': 3}

Mask before export, not after

Masking in the UI or deleting later still means the raw data travelled to and was stored by the backend. Mask in the SDK, inside your process, so sensitive values never leave it.

त्वरित जाँच: Where is the safest place to remove phone numbers from trace payloads?

• In the observability UI, by hiding the column
• In a weekly cleanup job on the backend database
• In the SDK's masking function, before data leaves the application
• In the model's system prompt