trulayer.redact (Python) and @trulayer/sdk/redact (TypeScript) modules scrub sensitive data from span inputs, outputs, and metadata before anything is transmitted to TruLayer. Redaction runs client-side, inside your process — no raw PII, secrets, or PHI ever reaches our servers.
Built-in packs
Enable one or more packs to get curated detectors for common sensitive data classes:
Packs compose — list as many as you need. Detected matches are replaced with typed sentinels like
<REDACTED:email> so the shape of your data is preserved for debugging.
Getting started
Redactor is attached at init, every span produced by auto-instrumentation or manual tracing is scrubbed on the way out.
Custom rules
Use therules argument to add regex-based detectors for domain-specific identifiers (employee IDs, internal customer numbers, ticket IDs, etc.). Each rule needs a name, a pattern, and a replacement sentinel.
- Python:
patternis a string (compiled withre). - TypeScript:
patternis aRegExp. Use thegflag to replace all occurrences.
Pseudonymization
If you need to correlate traces across runs — for example, to see that the same (unknown) user hit the same bug twice — enable pseudonymization. Matches are replaced with a stable HMAC-SHA256 hash instead of a static sentinel, so identical inputs produce identical tokens.Manual span scrubbing
For spans you construct by hand, call the redactor directly on the fields you want cleaned:redact_span / redactSpan uses the same packs and rules configured on the active Redactor.