Redact Cardholder Data

Telemetry from payment paths can carry cardholder data: a card number in a logged request body, a query string, an exception message, or a metric label. Cardholder data redaction detects likely payment card numbers and related sensitive data in logs, spans, web events, and metrics, and masks or replaces them. It runs in one of two places, or both:

• At ingestion: An opt-in dataset setting. Dash0 redacts the telemetry before it stores anything.
• On SignalControl Edge: The dash0redaction processor in your own edge collector. The collector redacts the telemetry before it leaves your network.

Both use the same detection and masking rules. Dash0 does not scan telemetry again after an edge collector has redacted it. See Combine Edge and Ingestion Redaction.

Ingestion redaction is a second line of defense for telemetry that your own filtering missed. Redaction at the source is the stronger guarantee, because the content never leaves your network. Use redaction on SignalControl Edge, or the OpenTelemetry Collector Contrib redaction processor in another collector. For browser telemetry, use the Web SDK's urlAttributeScrubber and ignoreUrls configuration options. None of these makes a dataset PCI compliant on its own.

Enable Cardholder Data Redaction

Redaction is off by default. You configure it per dataset under Settings → Datasets. To edit dataset settings, you need the Maintainer role on the dataset. Admin members always have it.

1. Open Settings → Datasets.
2. Select the dataset.
3. On the Overview tab, find the Cardholder data redaction section.
4. Enable Redact cardholder data.
5. Save the dataset.

Dash0 redacts telemetry that arrives after you save. It does not go back over telemetry it already stored. To stop redaction, disable Redact cardholder data. Values that Dash0 already masked stay masked.

Redact on SignalControl Edge

To mask cardholder data before telemetry leaves your network, add the dash0redaction processor to the pipelines of your edge collector. On the edge, the processor redacts everything it receives. It does not read the dataset setting. Adding the processor to a pipeline turns redaction on.

This example adds the processor to the logs pipeline of the reference collector configuration. Add it to the traces and metrics pipelines in the same way:

12345678910111213141516171819
processors:
  dash0redaction:
    metric_recorder: dash0metricrecorder/metering   # records the redaction metrics; without it the processor still redacts but records none

service:
  pipelines:
    logs:
      receivers:
        - otlp
      processors:
        - memory_limiter
        - dash0resource
        - dash0metering/logs
        - dash0filter
        - dash0redaction   # after every processor that adds or rewrites telemetry content
        - batch
      exporters:
        - dash0signaltometrics
        - otlp/dash0

Follow these rules when you add the processor:

• Place it after every processor that changes content: The collector marks each resource as redacted as soon as dash0redaction has run on it, and Dash0 does not scan marked resources again. A processor after dash0redaction that adds or rewrites content can therefore send unscanned values to Dash0.
• Reuse the existing metric recorder: Point metric_recorder at the dash0metricrecorder/metering extension that the metering setup already runs. A recorder extension supports exactly one drain receiver, so do not add a second one.
• Run the standalone edge collector: The processor ships in the standalone SignalControl Edge collector image. The edge collector that the Dash0 operator deploys on Kubernetes does not include it.

Combine Edge and Ingestion Redaction

When an edge collector has scanned a resource, Dash0 skips that resource at ingestion. It neither scans it again nor counts it again in the redaction metrics.

A single dataset can receive telemetry from an edge collector and from sources that send to Dash0 directly, such as a cloud integration. Dash0 decides for each resource:

• Telemetry that passed dash0redaction on an edge collector: The edge collector already redacted it. Dash0 does not scan it again, whatever the dataset setting.
• All other telemetry: Dash0 redacts it only if the dataset has Redact cardholder data enabled.

If a dataset receives telemetry from any source that does not pass through your edge collector, enable the dataset setting as well.

What Gets Redacted

Redaction scans these parts of each signal, at ingestion and on the edge alike:

• Logs: Log bodies (plain strings, nested maps, and lists), log record attributes, and scope attributes.
• Spans: Span names, span attributes, span event names, span event attributes, span link attributes, and scope attributes. This includes spans sent by the Web SDK.
• Web events: Web event bodies, web event attributes, and scope attributes, including web events that carry stack traces.
• Metrics: Data point attributes on every metric type, and scope attributes. Dash0 never inspects metric data point values.
• Resource attributes: Checked by attribute key only, on every scanned signal. Dash0 redacts a resource attribute whose key names a card field.

Dash0 masks card numbers and replaces everything else it detects:

Dash0 masks a card number instead of removing it, so the record stays useful for troubleshooting. PCI DSS forbids storing verification codes, PIN blocks, and track data in any form, so Dash0 replaces the whole value with <REDACTED>. Key matching redacts the value without reading it. If a field named card_number holds a token or an already-masked value, Dash0 still replaces it with <REDACTED>. Redaction never removes an attribute or body field. Dash0 stores an integer attribute that held a card number as the masked string.

Dash0 skips keys that cannot hold cardholder data: keys starting with dash0., k8s., service., telemetry.sdk., or otel., the keys trace.id and span.id, and any key ending in .timestamp.

Dash0 changes only the values it detects as card data. Everything else stays as it was, including timestamps, service and resource identity, span structure, and metric values. Dashboards, traces, and log searches keep working on redacted data.

Limitations

When you describe this control internally or to an assessor, state these boundaries:

• It never drops telemetry. Dash0 forwards every log record, span, web event, and metric data point, with the sensitive value rewritten. To drop telemetry by rule, use spam filters.
• It is not a compliance guarantee. Redaction is a defense-in-depth control with the gaps listed here. It reduces exposure but does not certify a dataset as free of cardholder data.
• It does not detect card numbers that are not literally present. Dash0 does not detect base64 or hex encoded, encrypted, tokenized, hashed, or JSON-escaped numbers. It also does not detect numbers split across several attributes.
• It does not detect cardholder names, expiry dates, or service codes. These have no recognizable shape. A field name such as cardholder_id does not reliably indicate card data.
• It does not detect bank account numbers, IBANs, or routing numbers. Those are not payment card data.
• It does not scan session recordings, metric values, or profiles. Dash0 stores Web SDK session recordings without redaction. Spans and web events from the Web SDK are scanned.
• It does not inspect resource attribute values. Dash0 derives resource identity from those values, so rewriting one would move the telemetry to a different resource.

Redaction can also produce false positives. Dash0 masks any 13 to 19 digit identifier that passes the Luhn check and starts with a digit in the payment-network range. It also redacts any field whose name contains cvv or cvc, whatever the field holds. A false positive costs you one masked value, and it shows up in the redaction metrics.

Monitor Redaction

Redaction records three metrics so you can prove the control ran and see what it did. All three are counters, so query them with increase() or rate(). They count items. An item is a log record, a span together with its events and links, or a metric data point.

• dash0.redaction.items_scanned: The number of items that redaction scanned. Without it, a redaction count of zero could mean clean data or a control that never ran.
• dash0.redaction.items_redacted: The number of scanned items with at least one masked or replaced value in the item itself. An item counts once, however many of its values matched. Redaction still masks matches in resource and scope attributes, but does not count them against the items beneath them.
• dash0.redaction.items_skipped: The number of items Dash0 did not scan at ingestion because an edge collector had already redacted them. Dash0 counts these only for datasets with Redact cardholder data enabled.

The ratio of dash0.redaction.items_redacted to dash0.redaction.items_scanned is the share of log records, spans, or data points that carried cardholder data.

All three metrics carry these attributes:

• dash0.redaction.signal: The signal type: logs, spans, or metrics. Web events count under logs.
• dash0.signal_control.environment: Which part of the pipeline counted the item. edge means an edge collector, saas means Dash0 ingestion. Use it to tell edge and ingestion counts apart in one query.

dash0.redaction.items_redacted also carries dash0.redaction.detection_method, which says how redaction detected the matches in the item. value means the content itself validated as a card number or track record. key means a field name matched and redaction replaced the value without reading it. key_and_value means the item had matches of both kinds.

An edge collector records its metrics in the dataset named by the resource's dash0.dataset attribute, or in default when the resource has none.

Further Reading

• About SignalControl Edge — Process telemetry inside your own network before it leaves, where you can add source-side redaction.
• Access Control — Roles and dataset permissions, including who can edit dataset settings.
• Datasets — How datasets separate telemetry and how to route data into them.
• Filter Out Spam — Drop telemetry by explicit rule when you want a signal gone rather than masked.
• Understand Web SDK and Data Privacy — Source-side filtering and IP anonymization for browser telemetry.