Logging policy and PII redaction

Two settings control what Logs stores for an execution. Verbose logging decides whether an entry keeps full inputs, outputs, token counts, and cost. PII redaction decides whether Runtype masks personal data in the entry before it stores it. You can set each one in more than one place, and a fixed precedence order picks the value that applies to a run.

Neither setting changes how an Agent or Flow runs, or the response that your caller receives. They change only what Logs keeps.

Verbose logging

Verbose logging is on by default. When it’s off for an execution, Logs doesn’t store the following details:

• Step and tool inputs and outputs, including prompt responses
• Model call transcripts
• Token counts
• Cost

Logs still records that the execution happened, its status, its duration, and error information. In the Logs list, the entry shows a logging off badge. When you open the entry, the detail view shows Verbose logging off.

Where you set verbose logging

The following table lists each place that you can set verbose logging and the values that it accepts:

In the API and in agent definitions, the Agent setting is the config.loggingPolicy field. Inherit from surface and Default both store default, which means “use the next setting in the order”.

Which verbose logging setting wins

Runtype checks the settings in the following order and uses the first one that is on or off:

1. The API request’s options.loggingPolicy
2. The Agent’s Verbose logging setting
3. The Surface’s Logging policy setting
4. The default, which is on

An API request can therefore turn verbose logging on for an Agent whose setting is Off. If you need an Agent’s runs to stay unlogged, don’t send options.loggingPolicy in requests that run it.

The following request runs a saved Agent without storing verbose details:

curl https://api.runtype.com/v1/dispatch \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "agent": { "agentId": "YOUR_AGENT_ID" },
    "messages": [
      { "role": "user", "content": "Where is my order?" }
    ],
    "options": { "streamResponse": false, "loggingPolicy": "off" }
  }'

Replace the following:

• YOUR_API_KEY: your Runtype API key
• YOUR_AGENT_ID: the ID of the saved Agent, which starts with agent_

PII redaction

PII redaction is off by default. When it’s on for an execution, Runtype replaces personal data in the entry’s content with a token that names the type of data. For example, dana@example.com becomes <EMAIL_ADDRESS>.

PII redaction detects the following types of data by their format:

• Email addresses, masked as <EMAIL_ADDRESS>
• Phone numbers, masked as <PHONE_NUMBER>
• Credit card numbers that pass a checksum, masked as <CREDIT_CARD>
• US Social Security numbers written with hyphens, masked as <US_SSN>
• Canadian Social Insurance numbers, masked as <CA_SIN>
• IBANs that pass a checksum, masked as <IBAN>

Detection matches formats, not meaning. Names, street addresses, and a nine-digit number with no separators aren’t masked.

Redaction applies to what Logs stores. It doesn’t change the conversation history that Runtype keeps for a chat, or the messages that the end user sees. Because conversation titles are generated from that unredacted history, a Surface that redacts doesn’t generate conversation titles.

Logs always masks secrets, such as API keys and tokens, whatever the PII redaction setting is.

Where you set PII redaction

The following table lists each place that you can set PII redaction and the values that it accepts:

The Agent editor doesn’t show a PII redaction field. To set it on an Agent, update the Agent through the API. The following request turns on PII redaction for a saved Agent and leaves the rest of its configuration unchanged:

curl -X PUT https://api.runtype.com/v1/agents/YOUR_AGENT_ID \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "config": { "piiRedaction": "redact" } }'

Replace the following:

• YOUR_AGENT_ID: the ID of the saved Agent
• YOUR_API_KEY: your Runtype API key

Which PII redaction setting wins

Runtype checks the settings in the following order and uses the first one that is off or redact:

1. The Agent’s config.piiRedaction
2. The Surface’s PII redaction setting
3. The default, which is off

An Agent set to off isn’t redacted, even on a Surface set to Redact. To make a Surface redact every Agent it runs, leave each Agent’s config.piiRedaction unset or set to default.

Settings for subagents

When an Agent delegates work to a subagent, the subagent’s run can’t store more than its parent’s run. The following rules apply:

• If the parent run has verbose logging off, the subagent’s run also has it off.
• If either the parent run or the subagent’s own setting redacts PII, the subagent’s run redacts PII. A subagent set to off under a redacting parent is still redacted.

Example

Kai runs a support chat Surface. Kai sets the Surface’s PII redaction to Redact and its Logging policy to Default. One of the Surface’s Agents, a billing Agent, has Verbose logging set to Off. Its config.piiRedaction is unset.

The following table shows what Logs stores for each Agent on that Surface:

Next steps

• What are Logs?: see what a log entry contains and how long Logs keeps it
• Working with Logs: filter, search, and export log entries
• What are Surfaces?: learn where Surface settings apply
• Manage agents as code: set loggingPolicy and piiRedaction in an agent definition
• Self-hosting (BYOC): control PII redaction for Agents that you run on your own cloud