Introducing Sensitive Data Redaction for Mastra Observability

With Mastra's new SensitiveDataFilter, you can automatically redact customer information from agent observability traces, or configure rules per-environment for application-specific fields.

The SensitiveDataFilter is enabled by default and ships with 15 default value fields — including password, ssn, and auth.

You can customize which fields to redact with the sensitiveFields array. Field matching normalizes case and separators, for example; api-key, api_key, and ApiKey would all match. You can also configure redaction styles, change the replacement token, and set different rules per-environment. E.g. partial for development, and full for production.

Before the SensitiveDataFilter, keeping secrets and PII out of your agent traces meant writing a custom span processor to sanitize tool inputs. Now the SensitiveDataFilter is enabled by default, catching and redacting sensitive field names automatically.

SensitiveDataFilter is a SpanOutputProcessor that recursively walks each span's attributes, metadata, input, output, and errorInfo — including nested objects, arrays, and JSON-encoded strings. To disable the functionality, set sensitiveDataFilter: false.

Get started

Install @mastra/observability:

npm install @mastra/observability

Default config

A default Observability config automatically redacts the default values and replaces sensitive data with [REDACTED]. Additional configuration may be required to ensure all customer-specific sensitive data is redacted.

import { Mastra } from "@mastra/core/mastra";
import { MastraStorageExporter, Observability } from "@mastra/observability";
 
export const mastra = new Mastra({
  // ...
  observability: new Observability({
    configs: {
      default: {
        serviceName: "mastra-dev",
        exporters: [new MastraStorageExporter()]
      }
    }
  })
});

Example output from default config:

{
  "email": "paul@example.com",
  "phone": "+44-20-7946-0142",
  "creditCard": "4111 1111 1111 1111",
  "ssn": "[REDACTED]",
  "apiKey": "[REDACTED]",
  "notes": "Priority customer since 2024. Prefers email contact."
}

Extended config

Define your own fields using the sensitiveFields array — this overrides the defaults, set the redactionStyle to full, and add a redactionToken. Use the configSelector to configure different rules per environment: NODE_ENV=development is the default, NODE_ENV=production selects production.

import { Mastra } from "@mastra/core/mastra";
import { MastraStorageExporter, Observability, SensitiveDataFilter } from "@mastra/observability";
 
export const mastra = new Mastra({
  // ...
  observability: new Observability({
    configSelector: () => process.env.NODE_ENV,
    configs: {
      default: {
        serviceName: "mastra-dev",
        exporters: [new MastraStorageExporter()]
      },
      production: {
        serviceName: "mastra-prod",
        exporters: [new MastraStorageExporter()],
        spanOutputProcessors: [
          new SensitiveDataFilter({
            sensitiveFields: ["email", "phone", "creditCard", "ssn", "apikey"],
            redactionStyle: "full",
            redactionToken: "*"
          })
        ]
      }
    }
  })
});

Example output from extended config:

{
  "email": "*",
  "phone": "*",
  "creditCard": "*",
  "ssn": "*",
  "apiKey": "*",
  "notes": "Priority customer since 2024. Prefers email contact."
}

For more information and full configuration options, see:

• Observability overview
• SensitiveDataFilter reference
• SpanOutputProcessor
• Sensitive data filter guide