Skip to main content
ProvenLog automatically redacts sensitive data before it enters the audit trail. Redaction runs in the processing pipeline on both server and embedded mode.

Built-in patterns

17 patterns are included out of the box:

What gets redacted

Redaction applies to content fields:
  • action_input
  • action_output
  • error_message
  • metadata values
  • labels values
Structural fields (agent_id, action_name, action_type, etc.) are never touched. Label and metadata keys are never modified — only their values.

Server-side redaction (Go)

Redaction is automatic when using plog serve. Add custom patterns via provenlog.yaml:
Custom rules are additive — built-in patterns are always active.

Embedded mode redaction (Python)

In embedded mode, redaction is also automatic. The client loads rules from the config file on startup. Custom rules in provenlog.yaml apply the same way as server-side.

Standalone usage

Use the Redactor class independently for any string processing:
Add custom patterns programmatically:
RedactionRule.pattern expects a compiled regex (re.compile(...)) not a raw string.

Configuration file discovery

The redaction config file is resolved in order:
  1. PROVENLOG_CONFIG environment variable
  2. ./provenlog.yaml (current directory)
  3. ~/.provenlog/config.yaml