Redact PII from application logs

Sanitext redacts PII from logs by sending each log line to its /v1/redact API, which masks names, emails, phone numbers, addresses, and secrets as [LABEL] tags before the line reaches Datadog, Splunk, or Sentry. Add it as logging middleware to shrink breach blast radius and compliance scope.

Logs leak PII. A user email in a stack trace, a phone number in a request body, an API key in a debug line. Once that data lands in Datadog or Splunk, it is copied, indexed, and retained across systems you do not fully control. Sanitext scrubs the sensitive parts at the source, before the log line leaves your process.

Sanitext vs metered redaction services for logs

Factor	Sanitext	Metered hyperscaler
AI cost model	Own model, zero per-token AI cost	Per-token, metered
Overage price	$0.35-$0.60 per 1M chars	~$1.00 per 1M chars
Where text is processed	Own Cloudflare infra	Third-party LLM or cloud service
Raw-text retention	None (counts and timings only)	Varies by provider
EU data residency	Yes (Enterprise)	Region-dependent
Languages	30+ in one pass	Varies

Why is PII in logs a problem?

Application logs are written fast and reviewed rarely. Developers log request bodies, headers, error context, and full objects to debug faster. That convenience pulls personal data straight into your observability stack.

Once a log line reaches Datadog, Splunk, Sentry, or cold storage, the PII inside it gets copied and indexed across many places. It sits in hot storage, archives, backups, and third-party SaaS. Every one of those copies widens your breach blast radius and pulls more systems into GDPR, CCPA, and SOC 2 scope.

Common offenders: emails and names in stack traces, phone numbers and addresses in serialized request payloads, and worst of all secrets like API keys, bearer tokens, and session IDs printed during debugging. Logs are also retained for months, so a single leaked record lingers far longer than the request that created it.

—Emails, names, and phone numbers in request and error logs
—Postal addresses and dates inside serialized payloads
—API keys, bearer tokens, and session secrets in debug lines
—PII copied into Datadog, Splunk, Sentry, archives, and backups
—Long retention windows that keep leaked data alive for months

What is the pattern for redacting PII from logs?

The fix is to redact at the source. You scrub each log line before it is shipped, not after it lands in your observability tool. That way the PII never gets written to disk or sent over the wire in the first place.

The cleanest place to do this is a logging middleware or a log processor or filter. Most logging frameworks let you hook in before output: a Python logging.Filter, a Winston format in Node, a Monolog processor in PHP. The hook calls Sanitext /v1/redact on the formatted message and replaces it with the masked version.

Sanitext returns the same text with spans masked as typed tags like [EMAIL], [PHONE], [FIRSTNAME], or [SECRET]. The structure of your log stays readable, you keep the label so you know what was there, and the raw value is gone before it leaves the box.

Why does Sanitext fit log redaction?

Logs are high volume and latency sensitive, so the economics and the data path matter more than for one-off tasks.

We own the open-weights detection model (Apache-2.0, from the OpenAI privacy-filter family) and run it on our own Cloudflare infrastructure. There is zero per-token AI cost, so pricing is flat and transparent instead of metered per call. Overage runs $0.35 to $0.60 per 1M characters, up to about 2x cheaper than metered hyperscalers at $1.00 per 1M.

Your log text never goes to a third-party LLM. We do not retain raw text, only counts and timings, which is the right default when the input is your own production logs. Enterprise plans add EU data residency and a DPA. One pass detects names, emails, phones, addresses, dates, URLs, account and card numbers, and secrets across 30+ languages, so multilingual logs need no extra config.

—Flat pricing, no per-token AI tax, overage $0.35-$0.60 per 1M chars
—Runs on our own Cloudflare infra, not a third-party LLM
—No raw-text retention; we log only counts and timings
—EU data residency and DPA on Enterprise plans
—30+ languages and labels for names, emails, phones, addresses, secrets

Integration notes for log pipelines

Redact before the log is shipped. Wire Sanitext into the formatter or processor stage so masking happens once, in-process, ahead of any transport to Datadog, Splunk, or Sentry.

For high throughput, batch and protect the hot path. Send larger chunks per call where your framework allows, set a short timeout, and fail open so a slow network call never blocks or drops a log. Cache nothing sensitive. Free tier gives you a one-time 300K characters to test, then Hobby covers 12M chars/month and Pro 120M.

Pair API redaction with cheap local rules for the highest-risk patterns. A regex that strips obvious secrets and known token prefixes before logging adds a fast, deterministic backstop. Sanitext then catches the contextual PII that pure regex misses, like names and addresses.

Be honest about what this buys you: redaction is data minimization, an aid that shrinks exposure and compliance scope. It is not anonymization and not a compliance guarantee. No detector is perfect, so keep tight retention and access controls on logs as defense in depth.

python

import logging, requests

SANITEXT_KEY = "pf_live_..."

def redact(text: str) -> str:
    try:
        r = requests.post(
            "https://api.sanitext.app/v1/redact",
            headers={"Authorization": f"Bearer {SANITEXT_KEY}"},
            json={"text": text},
            timeout=0.8,  # short timeout: protect the hot path
        )
        r.raise_for_status()
        return r.json()["text"]
    except requests.RequestException:
        return text  # fail open: never drop a log line

class RedactPIIFilter(logging.Filter):
    """Scrubs PII before the line is shipped to Datadog/Splunk/Sentry."""
    def filter(self, record: logging.LogRecord) -> bool:
        record.msg = redact(record.getMessage())
        record.args = ()  # message already formatted
        return True

logger = logging.getLogger("app")
logger.addFilter(RedactPIIFilter())

# "Login failed for jane@acme.com from +34 600 123 456"
# becomes "Login failed for [EMAIL] from [PHONE]"
logger.warning("Login failed for %s from %s", user_email, user_phone)

FAQ

Does redacting logs slow down my application?+

Sanitext adds one HTTP call per log line, so wire it into the formatter with a short timeout and fail-open logic. For high volume, batch lines, run redaction async off the hot path, and use a local regex backstop for obvious secrets so a slow call never blocks or drops a log.

Will Sanitext catch API keys and tokens in debug logs?+

Yes. The SECRET label targets API keys, tokens, and similar credentials, alongside emails, names, phones, addresses, dates, URLs, and account or card numbers. For known token prefixes you control, pair it with a fast local regex as a deterministic backstop, since no detector catches every pattern.

Does my log data get sent to a third-party LLM?+

No. Sanitext runs its own open-weights model on our Cloudflare infrastructure, so log text never reaches an external LLM provider. We retain no raw text, only counts and timings. Enterprise plans add EU data residency and a DPA for stricter requirements.

Does this make my logs GDPR or HIPAA compliant?+

No. Redaction is data minimization that shrinks breach blast radius and compliance scope, but it is an aid, not a guarantee. No detector is perfect, so keep short retention, tight access controls, and your own review. Treat Sanitext as one layer of defense in depth.

How much does it cost to redact logs at scale?+

Pricing is flat, billed on characters, with no per-token AI tax. Free gives a one-time 300K chars, Hobby is $29/mo for 12M, Pro $149/mo for 120M, Scale $499/mo for 450M. Overage runs $0.35-$0.60 per 1M chars, up to roughly 2x cheaper than metered hyperscalers.

Scrub your logs before they ship

Get an API key and add log redaction in 60 seconds. Free tier includes a one-time 300K characters, no card required. Try the /v1/redact endpoint on your own log lines in the playground.

Get your free API key