Per call, the SDK captures: the full prompt sent, the full completion received, the model identifier, token counts, cost estimate, latency, parent/child span relationships, and any metadata you attach. Tool-call arguments and results are captured verbatim unless you mark a field sensitive.

We do not capture: application-level secrets, user passwords, bearer tokens, or any field tagged @loupe.redact. The SDK inspects your request bodies for common secret shapes and strips them before transmission.

A client-side redaction pass runs before any payload leaves your process. Defaults: email, phone, SSN, credit-card, bearer tokens, API keys for major providers. Decorate your own types with @loupe.redact("email") to add rules.

@loupe.redact("email", "phone")
class User: ...

# emails and phones in User payloads are replaced
# with deterministic placeholders before send

Redaction runs before the span leaves your process; even if our ingress is breached, redacted fields never existed on the wire.

Default retention on the hosted tier is 30 days for raw spans and 365 days for aggregate metrics. Paid tiers configurable 1-730 days. Expired data is deleted within 24 hours of its retention boundary; no dark copies.

You can trigger an immediate delete of a trace or all traces for a user id via loupe purge --user-id=….

Spans are stored in an append-only column store, encrypted at rest with AES-256 (per-tenant keys). Transport is TLS 1.3 only. The hosted control plane runs in eu-west-1 or us-east-1; you pick at project creation. No cross-region replication unless you enable it.

Audit logs for data access are exposed via the audit API.

The entire stack ships as a single Docker image and a Helm chart. Your ingress, your object store (S3-compatible), your keys. The SDK is configured with one env var: LOUPE_URL.

Self-hosted has feature parity. Updates are signed releases pulled from a public registry.