Data retention and privacy in logs

Read these first

• LLM tracing

What you will know

• Redact sensitive content from traces without destroying their value

  Use field-level and pattern-based controls, then verify that identifiers, secrets, and useful correlation context are handled differently.

• Configure zero-retention where it is required

  Test provider-side behavior and account for transient processing, backups, support access, and metadata that may remain outside the declared retention window.

• Pin processing to a region and prove it

  Collect request routing, provider, storage, and failover evidence because a regional control may not cover telemetry or degraded paths.

• Honour a deletion request across logs, traces, and eval sets

  Make the workflow discover derived copies and asynchronous indexes, and produce an auditable completion result rather than trusting a single delete response.

• Trace and inventory every outbound payload and metadata field on each call

  Include retries, tool calls, observability exporters, and vendor-managed diagnostics so undocumented egress cannot bypass the privacy policy.

Chapters

1. 1

   Redact by field class and keep the structure around it

   A regular-expression pass over prompt and completion text misses the complainant identified by circumstance and mangles the content engineers need, so redaction starts by classifying fields at source and applying a policy per class, with patterns kept as a backstop. Preserve what makes a trace debuggable — field names, lengths, token counts, retrieved document ids and scores, prompt and model versions, error codes, correlation keys — and gate raw text behind a short window.

   Read chapter
2. 2

   Masking at read time controls who looks, not what you hold

   Storing everything and masking it in the trace viewer feels like the careful option and governs only access: the unredacted copy still sits inside your retention window, your residency commitment, and every deletion request. Hashing user content keeps traces joinable and is not anonymisation, because the join key is what re-identifies. Covers what each control actually buys and which obligation each one silently leaves unmet.

   Read chapter
3. 3

   A zero-retention flag covers the provider, not your company

   The checkbox covers the provider's declared storage of prompts and completions. Transient processing, abuse-monitoring buffers, support access, backups, and metadata such as token counts and model identifiers sit outside it — and your own traces, evaluation sets, and telemetry sit outside it entirely. Covers the sentence you can honestly sign, what to verify before signing it, and how to answer 'prove it was on all along' six months later.

   Read chapter
4. 4

   One request sends more than the prompt and the completion

   Asked to inventory what leaves the network on a single assistant request, teams answer with the prompt and the completion. Every retry re-sends the payload, tool arguments and tool results both cross the boundary, the system prompt carries internal identifiers and policy, spans exported to your observability vendor include prompt attributes, and crash reports ship request bodies to a third party. Covers building that inventory and keeping it true.

   Read chapter
5. 5

   A region setting is a claim; the paths are the evidence

   Opening the console to show an endpoint's region establishes intent for one component someone thought to configure. Evidence is every path a payload or payload-derived field can take: request routing, provider region, where responses and traces are stored, asynchronous jobs, telemetry export, and the fallback that sends EU traffic to a US region when the primary errors. Covers what to tell an auditor about that fallback rather than hoping it goes unasked.

   Read chapter
6. 6

   Deletion has to find the copies nobody registered

   Deleting the user's rows and replying 'completed' leaves the same content in request traces, a curated evaluation set, a vector index rebuilt nightly from a source that still holds it, the analytics warehouse, an error-reporting SaaS, and the provider's own retention. Two of those never expire by design. Covers which systems you cannot simply issue a delete against, what auditable completion evidence looks like, and how to make the next request routine.

   Read chapter