Security by Design

Your data, your rules.

Traccia gives you a clear choice — rich Full-trace mode for debugging, or Metadata-only mode for sensitive production workloads. Capture exactly what your compliance posture allows, no more.

Full-trace mode

Best for development & debugging. Capture deep execution details:

  • Model, Tokens, Cost, Latency
  • Prompts & Completions (truncated)
  • Tool inputs/outputs
  • Retries & Errors
  • Guardrail evaluations

Metadata-only mode

Best for regulated production workloads. No prompt or completion text.

  • Timing, Token Usage, Cost
  • Retry counts & Tool usage stats
  • Policy evaluations
  • Outcome status
  • No prompts or completions
Switch with truncation limits, skip_args / skip_result, and PII redaction — all in the SDK, before any data leaves your process.

Built-in PII redaction. Default on.

Redaction is on by default to protect sensitive data out-of-the-box. Enable init(redact_pii=True) to explicitly configure and mask emails, US phone numbers, and SSN-like patterns on sensitive span attributes before export. Use redact_string() for manual control. Pattern-based today; ML-based detection on the roadmap.

Designed for production trust, not experimentation

Many agent tools are built for development and debugging, requiring deep inspection of prompts. Traccia is built for operations at scale.

Payload inspection is a security risk

Centralizing sensitive data creates a massive attack surface.

No data exfiltration

By design, Traccia avoids becoming a data exfiltration surface.

Enterprise-ready Architecture

  • No proxying of customer API calls
  • No storage of secrets or credentials
  • Clear ownership boundaries across orgs
  • Every span carries governance metadata and integrity hashes, producing audit-friendly, verifiable execution evidence for compliance reviews

Safer by default, configurable when needed

Strict SDK Schemas

Prevents accidental data capture at the source.

Truncation & Redaction

Configurable truncation and PII redaction run inside the SDK before export.

End-to-End Encryption

Data encrypted in transit (TLS 1.3) and at rest (AES-256).

No secrets in logs

API keys and credentials are never written to logs.

Observe behavior. Control risk. Protect data.

Traccia gives you visibility into how agents behave, decide, and spend — without ever asking to see what they think or what they process.

That boundary is intentional.