Telemetry from payment paths can carry cardholder data, such as a card number in a logged request body, a query string, or an exception message. Filtering it at the source is the strongest control, but a new service or a forgotten rule can still let one through.
Turn on Redact cardholder data for a dataset, and Dash0 detects likely card numbers in logs, spans, web events, and metrics before it stores them. Card numbers keep their first six and last four digits, such as 411111******1111. Verification codes, PIN blocks, and track data become <REDACTED>. Dash0 never drops a record, so traces and log searches keep working. Detection is pattern-based, so it does not catch encoded, encrypted, or split card numbers.
Two metrics, dash0.redaction.values_scanned and dash0.redaction.values_redacted, show what Dash0 scanned and what it redacted. See Redact Cardholder Data for what gets redacted, the limitations, and how to turn it on.