How to Answer
“Two destinations, two different controls.
For the provider: a zero-retention endpoint if the contract offers one, and I’d treat that as the primary control because it’s contractual and verifiable. Redaction is the secondary control, on what we send.
For our own traces — that’s where I see most of the leakage, because tracing gets set up by engineers to be maximally useful and it captures whole prompts. If those prompts carry customer data, your observability vendor is now a subprocessor holding PII for thirty days, and it’s usually on nobody’s data map.
The mechanism I like is tokenised redaction rather than deletion: detect the entity, replace it with a stable placeholder before the call, swap it back on the way out. The model reasons about PERSON_1 and ACCOUNT_2 perfectly well, the real values never leave the process, and the trace is still readable when you need to debug.
And I’d be honest that detection is imperfect — so redact by default, allowlist what’s permitted through, and sample-audit what actually got sent.”