Data handling
Minimize personal and sensitive information in agent traces before sending data to Tensile.
Watch the workflow: Save and read recorded review evidence · Authored dummy data
The video shows the earlier Review evidence navigation. Migrated workspaces use Investigations → Saved evidence for the same source pins.
See the recorded fields, note and expiry preserved by one saved review pin. This clip uses authored dummy data. It does not demonstrate automatic redaction, ingestion minimization, contractual controls or provider processing. Save an authored dummy tool run with a note, then open its preserved input and output. A saved pin is not a correctness label or customer outcome.
Read the walkthrough transcript
- 00:00 — Inspect an authored dummy tool run in Tensile. The session outcome remains unknown.
- 00:06 — Save the recorded run with a note. This is evidence, not a correctness label.
- 00:12 — Open the saved item. Read its note, expiry and recorded-text hashes.
- 00:18 — Read the preserved timeout. Unrecorded evidence and correctness judgments are not included.
Tensile needs trace evidence to help teams review agent behavior. Trace inputs, outputs, tool arguments, results, and metadata can contain personal or sensitive information. Design your instrumentation and source configuration to send only what your team is authorized to process.
Use opaque user identifiers
Send a stable identifier that does not disclose a person's name, email address, or account number. Keep any mapping to a real identity in your own system.
{
"user_data": {
"user_id": "user_8f21",
"traits": {
"plan": "enterprise",
"region": "eu-west"
}
}
}Only add user traits and session metadata that support a defined product or review need. Treat metadata as trace data: it can be stored and displayed with the case evidence.
Minimize and redact trace content
Before sending a turn or connecting a source, decide which fields the evaluator actually needs. Remove credentials, secrets, and unrelated personal details. Redact free text and tool arguments when possible; allowlist metadata keys instead of forwarding entire request objects.
If you connect Braintrust or Langfuse, review the selected projects, date range, metadata fields, and retention settings before syncing. Connecting a source makes its configured trace data available to Tensile; it does not replace your own data-minimization review.
Consider model processing
Some enabled evaluator workflows use model calls on selected trace evidence. Before enabling them, confirm which fields are included, which provider is configured, and whether that processing is permitted for your data. A draft pack's evidence recipe should make the intended input inspectable. Keep highly-sensitive fields out unless the applicable agreement and configuration explicitly allow them.
Keep credentials private
Use ingestion and connector credentials only on trusted servers or in the dashboard's secure connection flow. Never place an API key in browser code, source control, or a customer-facing app. Revoke a key if it is exposed.
For the current contractual terms, retention, and security controls, refer to your organization's agreement or contact your Tensile administrator. These controls can vary by workspace and plan.