Skip to main content
Laminar is an open-source, OpenTelemetry-native observability platform for AI agents. PII redaction is a project-level setting that runs every span through a PII detection model before storage and replaces names, emails, secrets, phone numbers, and other detected entities with [REDACTED_<LABEL>] placeholders. It has three modes: redact nothing, redact for everyone, or store the original once and redact per reader. Detection runs at ingest, in line with the rest of trace processing. By the time a span is searchable, in the trace view, or queryable from SQL, the decision about what is PII has already been made.

​
Modes

On is the right choice when raw user data must never land in your trace store, search index, or exports. Dual is for teams where a few people need the real conversation to debug an incident, while the rest of the workspace, and any API key or CLI session, only ever needs the redacted version.

​
Enabling it

Go to Project Settings → Security and pick a mode under PII in spans. Only workspace owners and admins can change it. The change applies to every new span ingested for that project; existing traces are not rewritten retroactively.
Security tab with the PII in spans mode selector

Security tab with PII in spans set to Dual. Every span ingested for this project is now screened at ingest and redacted per reader.

The setting is per-project, not per-workspace. A workspace can mix modes (for example, a production project on Dual and a staging project on Off).

​
What gets redacted

The detector runs over the input and output fields of every span: LLM messages, tool-call arguments and results, function inputs and outputs. It detects and replaces:
  • Personal names
  • Email addresses
  • Phone numbers
  • Account numbers, card numbers, and similar identifiers
  • Other entities the model classifies as PII
Each detected entity is replaced with a labelled placeholder, e.g. [REDACTED_PRIVATE_EMAIL], [REDACTED_PRIVATE_PERSON], [REDACTED_ACCOUNT_NUMBER]. The structure of your span input/output (JSON shape, message role fields, tool-call IDs) is preserved: only the offending substrings are rewritten. Placeholders look the same in On and Dual.

​
What is never redacted

Some fields are structurally meaningful and pass through untouched in every mode:
  • Object keys in JSON inputs and outputs. A key called email stays; the email value gets redacted.
  • Span attributes other than input and output: span name, type, status, duration, token counts, cost, model name.
  • Trace and span IDs, parent IDs, and the message-role / tool-call-id fields the model needs to follow conversation structure.
Redaction covers span input and output only. Signal events, datasets, evaluation datapoints, and browser session recordings are not redacted in any mode; if you push a span into a dataset, the copy is whatever you were shown at the time. If you’ve passed a user identifier through setTraceUserId / set_trace_user_id (see User ID), that value is trace metadata and is not affected by this setting. Strip user IDs upstream if your compliance posture requires it.

​
Dual mode: who sees what

In Dual mode the same span renders differently depending on who is reading:
  • Workspace owners and admins see the original data.
  • Workspace members see PII replaced with placeholders.
  • Public share links see placeholders.
  • Project API keys (the public API, /v1/sql/query, and the MCP server) and CLI sessions (lmnr-cli sql, lmnr-cli ask) always see placeholders, regardless of the role of the person who created the key or logged in. This is what makes it safe to give a coding agent access to a project.
This applies wherever span input and output are read: the trace and session views, the traces and spans tables, the SQL editor (spans and traces), exports, and the MCP tools.
Spans ingested before switching to Dual were never screened: restricted readers see "[PII_MASKED_UNAVAILABLE]" instead of the input or output, never the original text.

​
What you’ll see in traces

Traces ingested with redaction look the same in the transcript view: same structure, same nesting, same tool calls. The difference is in the content cells. A user message that was previously:
is rendered as:
The same applies to LLM outputs, tool-call arguments, and tool-call results. Token counts and timing are unchanged. Full-text search indexes the redacted text in both On and Dual, so a search for the original email returns nothing. That is the point.
Detection runs at ingest, so changing the mode does not retroactively redact existing traces. New traces from the moment you switch are screened; older traces stay as they were stored (and, under Dual, are hidden from restricted readers as described above).

​
Availability

PII redaction is available on Pro and Enterprise plans on Laminar Cloud, in all three modes. Self-hosted deployments can use the same setting by running the PII redactor service alongside the rest of the stack; it is required for both On and Dual. See the self-hosting configuration page for setup.

​
Where to go next

Viewing traces

See how redacted spans render in transcript view.

Signals

Define outcome and failure detectors that work over redacted traces.

SQL editor

Query across redacted traces with SQL. Placeholder strings are searchable.

Self-hosting

Run Laminar in your own cluster, including the PII redactor service.