Mask Span Attributes: Redact Sensitive Trace Data

About

Traces often contain sensitive data: user messages, API responses, PII, or large base64-encoded images. Sending all of this to a trace backend creates privacy, compliance, and payload size problems. Masking span attributes removes or truncates this data before it leaves the application. Configuration is available at two levels: environment variables for global defaults across all instrumentors, and TraceConfig in code for per-instrumentor control.

When to use

• Privacy and compliance: Hide user inputs and LLM outputs to prevent sensitive data from being stored in trace backends.
• Image redaction: Suppress base64-encoded images from input messages or cap their length to reduce payload size.
• Selective masking: Hide only specific parts of a span (e.g. input text but not output messages) while keeping the rest visible.
• Environment-specific config: Use environment variables for deployment-level defaults and TraceConfig in code for per-instrumentor overrides.

How to

from fi_instrumentation import TraceConfig

config = TraceConfig(
    hide_inputs=False,
    hide_outputs=False,
    hide_input_messages=False,
    hide_output_messages=False,
    hide_input_images=False,
    hide_input_text=False,
    hide_output_text=False,
    hide_embedding_vectors=False,
    base64_image_max_length=32000,
)

from traceai_openai import OpenAIInstrumentor
OpenAIInstrumentor().instrument(
    tracer_provider=trace_provider,
    config=config,
)

const { OpenAIInstrumentation } = require("@traceai/openai");

const instrumentation = new OpenAIInstrumentation({
    traceConfig: {
        hideInputs: false,
        hideOutputs: false,
        hideInputMessages: false,
        hideOutputMessages: false,
        hideInputImages: false,
        hideInputText: false,
        hideOutputText: false,
        hideEmbeddingVectors: false,
        base64ImageMaxLength: 32000,
    },
});

Key concepts

• TraceConfig:An object accepted by all traceAI auto-instrumentors. Use it to specify masking settings directly in code, scoped to a single instrumentor.
• Environment variables:Global defaults applied to all instrumentors. Useful for deployment-level configuration without changing code.
• Precedence order:TraceConfig in code → environment variables → default values. More specific settings always win.
• hide_inputs / hide_outputs:Broad flags that hide all input/output values and messages in one setting.
• base64_image_max_length:Caps the logged length of base64-encoded images. Default is 32,000 characters.

Next Steps