Skip to main content
Tensile needs trace evidence to help teams review agent behavior. Trace inputs, outputs, tool arguments, results, and metadata can contain personal or sensitive information. Design your instrumentation and source configuration to send only what your team is authorized to process.
Do not assume Tensile will remove or pseudonymize sensitive values for you at ingestion. Clean or omit them before sending traces, and confirm that your organization’s data use is covered by its agreement and settings.

​
Use opaque user identifiers

Send a stable identifier that does not disclose a person’s name, email address, or account number. Keep any mapping to a real identity in your own system.
Only add user traits and session metadata that support a defined product or review need. Treat metadata as trace data: it can be stored and displayed with the case evidence.

​
Minimize and redact trace content

Before sending a turn or connecting a source, decide which fields the evaluator actually needs. Remove credentials, secrets, and unrelated personal details. Redact free text and tool arguments when possible; allowlist metadata keys instead of forwarding entire request objects. If you connect Braintrust or Langfuse, review the selected projects, date range, metadata fields, and retention settings before syncing. Connecting a source makes its configured trace data available to Tensile; it does not replace your own data-minimization review.

​
Consider model processing

Some enabled evaluator workflows use model calls on selected trace evidence. Before enabling them, confirm which fields are included, which provider is configured, and whether that processing is permitted for your data. A draft pack’s evidence recipe should make the intended input inspectable. Keep highly-sensitive fields out unless the applicable agreement and configuration explicitly allow them.

​
Keep credentials private

Use ingestion and connector credentials only on trusted servers or in the dashboard’s secure connection flow. Never place an API key in browser code, source control, or a customer-facing app. Revoke a key if it is exposed. For the current contractual terms, retention, and security controls, refer to your organization’s agreement or contact your Tensile administrator. These controls can vary by workspace and plan.