PII redaction

​

Enable redaction

import zeroeval as ze

ze.init(
    api_key="YOUR_API_KEY",
    redaction={"enabled": True},
)

import * as ze from "zeroeval";

ze.init({
  apiKey: "YOUR_API_KEY",
  redaction: { enabled: true },
});

export ZEROEVAL_REDACT_PII=true

​

What gets redacted

• inputs and outputs
• attributes
• error messages and stacks
• session names
• tag values

• email addresses
• phone numbers
• SSN-style identifiers
• PAN / credit card numbers
• bearer tokens, JWTs, and common API key formats
• cookie and authorization header values
• IP addresses

​

What stays intact

• span names
• trace IDs and span IDs
• timing and status fields
• token counts, model/provider metadata, and cost metadata unless the value itself is sensitive

​

Placeholder behavior

alice@example.com -> [REDACTED_EMAIL_A]
bob@example.com   -> [REDACTED_EMAIL_B]
alice@example.com -> [REDACTED_EMAIL_A]

• the same normalized sensitive value in one trace gets the same placeholder
• different values in the same trace get different placeholders
• placeholder assignment resets per trace
• matching is exact after normalization only
• this is not fuzzy identity resolution

​

Normalization and limitations

• there is no reversible backend token vault
• there is no de-anonymization support
• there is no fuzzy entity resolution across semantically related strings
• bypassing SDK capture paths bypasses this protection

​

Examples

import zeroeval as ze

ze.init(
    api_key="sk_ze_demo_local",
    redaction={"enabled": True},
)

with ze.span(
    name="pii-redaction-demo",
    session={"id": "alice@example.com", "name": "Alice alice@example.com"},
    tags={"customer_email": "alice@example.com"},
) as span:
    span.set_io(
        input_data={"email": "alice@example.com", "phone": "+1 (415) 555-1234"},
        output_data={"result": "Reach alice@example.com"},
    )
    span.set_error(
        code="ValueError",
        message="Failed for alice@example.com with Bearer secret-demo-token",
    )

import * as ze from "zeroeval";

ze.init({
  apiKey: "demo-api-key",
  redaction: { enabled: true },
});

const span = ze.tracer.startSpan("demo.pii_redaction", {
  sessionId: "alice@example.com",
  sessionName: "Alice Example <alice@example.com>",
  tags: { customer_email: "alice@example.com" },
});

span.setIO(
  {
    email: "alice@example.com",
    phone: "+1 (415) 555-1212",
    apiKey: "sk-live-abcdef1234567890",
  },
  "Send follow-up to alice@example.com and bob@example.com"
);