Data redaction
Spans capture the input and output of each operation, including prompts, responses, and tool call arguments and results. This data can contain secrets or personally identifiable information (PII). To limit what leaves your environment, Mistral applies client-side redaction: spans are scrubbed on the machine that produces them, before they are exported to our platform.
Redaction is on by default across Mistral products and SDKs. It is best-effort and based on regular expressions, so it removes the patterns it recognizes while keeping the structure of your spans intact. The one exception is when you run your own OpenTelemetry pipeline, where you opt in explicitly (see below).
Redaction is a safety net, not a guarantee. The default policy targets common secret and PII patterns, but it can miss free-form PII or secrets that do not match a known pattern. Do not rely on it as the only control for highly sensitive data.
How redaction works
How redaction works
Redaction runs at the OpenTelemetry exporter level, so it applies to every span regardless of how the span was created. Each span attribute is inspected and rewritten according to the active policy before the span is sent. The original, unredacted span never leaves the process.
Because it runs on the client, redaction adds no extra round trip and keeps sensitive data off the network entirely.
Redaction policies
Redaction policies
Every surface exposes the same three modes. The SDKs additionally let you supply your own policy.
| Mode | What it does | Trade-off |
|---|---|---|
default (on) | Content-oriented. Scans string values and redacts matched secrets and PII (API tokens, emails, card-like sequences, IPv4 addresses) while keeping attribute keys and structure. | Preserves most observability value. Best-effort, so it may miss patterns outside the known set. |
strict | Key-oriented. Redacts whole values for sensitive keys and all non-primitive values, then scans the remaining values for secret patterns. | Very conservative. Erases most prompt and response content. |
none | No redaction. Spans are exported as captured. | Full fidelity. Use only in trusted environments. |
| Custom (SDKs only) | Supply your own policy or a per-attribute callback that decides how each value is masked. | Full control. You own the logic. |
Redaction by source
Redaction by source
| Source | Default | Configurable | Where |
|---|---|---|---|
| Mistral SDK (Python) | On | Fully | redaction argument on configure_telemetry |
| Mistral SDK (TypeScript) | On | Fully | redaction option on configureTelemetry |
| Workflows | On | Yes | OTEL_REDACTION environment variable |
| Vibe Code CLI | On | Yes | otel_redaction config or VIBE_OTEL_REDACTION |
| Vibe Work | On | No | Managed by Mistral, server-side |
| Custom (OTEL) | Off | Yes | Wrap your exporter with RedactingSpanExporter |
Configure redaction
Configure redaction
Redaction is on by default in dedicated mode. Pass the redaction argument to change it:
from mistralai.extra.observability import (
configure_telemetry,
AttributeRedactionPolicy,
)
configure_telemetry(client) # default policy
configure_telemetry(client, redaction=AttributeRedactionPolicy()) # strict, key-oriented
configure_telemetry(client, redaction=False) # disabled
configure_telemetry( # custom per-attribute callback
client,
redaction=lambda key, value: None if "email" in key else value,
)If you point the SDK at your own OpenTelemetry setup instead of letting it manage tracing, the SDK no longer owns the exporter and the redaction argument has no effect. Redact in your own pipeline instead (see the Custom (OTEL) tab).
For more detail, see the redaction section of the SDK README and the observability examples.
FAQ
FAQ