Every request can produce a request log. The privacy mode governs how much of the prompt and response content that log retains. It is resolved per environment (from the project default) and can be tightened per request. Privacy is applied in the metering worker before anything is persisted — never in the request path — so content that a mode excludes is never written to storage in the first place.

​
The four modes

The modes are ordered from least to most strict: full → redacted → metadata → none.

​
Defaults and inheritance

The privacy mode is safe-by-default and resolved in this order:
  1. The environment’s explicit privacy_mode, if set.
  2. Otherwise a name-based default: a development environment inherits the project default (default_privacy_mode, itself full unless you change it); any production-like environment defaults to metadata.
So out of the box, development stores full content (you want to see everything while building) and production stores metadata only (content is not retained unless you opt in). You can override the mode on either environment in the dashboard.

​
Tightening per request

A single request may only tighten the resolved mode via metadata.privacy — it can move toward less retention (e.g. full → metadata), never toward more. You can never widen capture beyond the environment’s configured mode from a request.

​
What redaction removes

In redacted mode, every string leaf of the logged prompt and response is passed through a set of patterns, and matches are replaced with typed placeholders ([redacted:email], [redacted:phone], [redacted:card], [redacted:key]) so neither the value nor its exact shape survives:
  • API-key-shaped strings (Roadie keys, OpenAI keys, AWS access-key ids, bearer tokens)
  • Email addresses
  • Credit-card-shaped digit runs (13–16 digits)
  • Phone numbers
The structure of the payload is preserved; only string values are rewritten. Redaction is a best-effort PII pass, not a compliance guarantee — for sensitive production traffic, prefer metadata or none.

​
What is always true

  • The usage record (tokens, cost, status) is always kept regardless of mode — it is what metering and billing run on. Privacy only governs prompt/response content.
  • A streamed response is logged as its reassembled final content (subject to the mode), not as individual delta frames.
  • Per-environment log_retention_days (default 30) ages out old logs automatically.

​
Choosing a mode

Use full in development and for debugging; use redacted when you need content for evaluation but must strip common PII; use metadata or none in production when prompts are sensitive and you only need operational metrics. For the compliance angle, see Privacy & compliance; for where this sits per environment, see Tenancy & isolation.