Sentry: Mask user messages in traces #1168
Description
Is your feature request related to a problem?
User messages are currently visible in Sentry traces, raising privacy concerns. A 7-day trace retention is insufficient as NGOs may report issues after a week.
Describe the solution you'd like
- Investigate the feasibility of masking user messages in traces.
- If masking is not possible, configure trace retention to ~30 days.
- Document the decision as part of the ops/observability workstream.
Original issue
Context
User messages are currently visible in Sentry traces (not logs), which is a privacy concern.
Decision (to investigate)
Either:
- Mask user messages in traces, OR
- Set trace retention to ~30 days.
7-day retention is too short since NGOs sometimes raise issues after a week.
Acceptance criteria
- Determine feasibility of masking user messages in traces.
- If not masking, configure trace retention to ~30 days.
- Decision documented as part of the ops/observability workstream.
Activity
[-]Investigate Sentry trace retention and user-message masking[/-][+]Sentry: Mask user messages in traces[/+]vprashrex commentedon Oct 24, 2026
Checked this against prod. User messages are already kept out of Sentry: prompt and response content is stripped from every span and log before it's sent, request bodies are never sent, and the user query and instructions are redacted from task arguments. None of the message-content keys show up in any prod span over the last 30 days. I also added the newer OTel names (
gen_ai.input.messages/gen_ai.output.messages) to the masked list in #1090 so a future SDK can't slip them in. Retention isn't a problem anymore either, prod traces go back 90 days. Details are in the observability wiki under Redaction.