TracerYX Cloak / Evaluation guide
Local redaction.
A clear integration path.
Protect supported trace data inside your environment before sending it to your collector. This guide describes the current local processing preview.
1. Start with a representative fixture
Contact our team for the preview package and version-specific installation instructions. The commercial release is subject to signing trust, legal/model redistribution approval and operator configuration. This guide does not provide an unrestricted public package download.
- Use Node.js 22 and an isolated evaluation environment.
- Obtain the matching package, installation instructions and applicable integrity checks from the team. For signed releases, verify the archive against its signed manifest using an independently trusted key fingerprint before installation.
- Choose a customer-owned OTLP HTTP/JSON collector endpoint and generate a local bearer token in your own secret manager.
- Run synthetic traces first. Inspect the protected output and failure behavior before evaluating customer data under your own access controls.
The raw trace processing path runs locally. Account access, release delivery and commercial support remain separate services.
2. Configure the local sidecar
After installing the supplied package, configure the sidecar through its process environment. Inject a bearer token containing at least 32 non-whitespace characters from your secret manager; do not put it in command arguments, source control or logs.
# Inject TRACERYX_OTLP_BEARER_TOKEN separately from your secret manager.
export TRACERYX_OTLP_UPSTREAM_URL=https://collector.example/v1/traces
export TRACERYX_OTLP_PORT=4319
export TRACERYX_OTLP_MODE=tokenize
export TRACERYX_OTLP_THRESHOLD=0.20
# Run with the environment settings above loaded into the process.
npx --no-install traceryx-otlp-redactorThe collector URL above is an example; replace it with your own fixed endpoint. The sidecar binds to 127.0.0.1. Configure your exporter for HTTP/JSON, send to http://127.0.0.1:4319/v1/traces and supply the local bearer token in the Authorization header.
Select the mode explicitly. Use tokenize for opaque aliases or redact for redaction. The sidecar defaults to redact if the mode is omitted.
Choose sensitivity based on your workload
High coverage: 0.05. Balanced: 0.20. Preserve text: 0.40. Lower thresholds can catch more identifiers and remove more ordinary text. These scores are not privacy probabilities; mandatory deterministic findings remain active. Review the measured tradeoffs before selecting a threshold.
3. Stay within the supported input contract
The qualified integration handles a strict subset of OTLP HTTP/JSON traces. Configure your exporter to match that contract.
| Input or behavior | Current scope |
|---|---|
| Traces | Authenticated POST /v1/traces, application/json, up to 4 MiB per request. |
| Protected fields | Supported human text fields and attributes; semantic keys guide classification. |
| Trace structure | Validated trace IDs, span IDs, timestamps and structural fields are preserved. Correlation metadata can still be sensitive. |
| Rejected inputs | Logs, metrics, protobuf, gRPC, gzip, binary attributes, unknown extensions, malformed identifiers and duplicate JSON keys. |
| Field limits | 64 KiB per field; additional depth, size and concurrency limits apply. |
4. Understand what a token means
Repeated exact values of the same entity type share an alias within a call or batch. New batches receive new aliases. This makes related values recognizable within the protected payload without providing a persistent reverse vault.
Before
user_email: "jordan.patel@example.com"
backup_email: "jordan.patel@example.com"
handling_note: "Keep it refrigerated"
After / illustrative aliases
user_email: "[EMAIL:same-token]"
backup_email: "[EMAIL:same-token]"
handling_note: "Keep it refrigerated"Values classified as secrets or payment data are discarded. Sensitive numeric values can become string values after protection. Tokens protect detected identifiers; missed identifiers remain a detection risk.
5. Test failure handling before rollout
Malformed or unsupported inputs are rejected. Processing and export failures never trigger a fallback that forwards the raw request.
- Valid collector partial-success responses remain HTTP 200 with a sanitized partial-success body. Do not retry them: the collector may already have accepted spans.
- Throttling returns 429. Upstream connection failures, timeouts, overload and 5xx responses map to sanitized retryable 503 responses.
- Permanent upstream 4xx responses map to a nonretryable 400. Redirects and invalid or oversized responses map to a sanitized 502.
Inspect status codes, collector output and application behavior with synthetic fixtures. Do not bypass the sidecar or resend raw traces when protection fails.
6. Evaluate the release boundary
Cloak is a local processing preview. Benchmark results are dataset-specific and do not establish perfect redaction, clinical readiness or a compliance certification. Test representative traces for both missed identifiers and removed useful text.
The TracerYX agent platform’s tracing, explicit tool guards and signed evidence are separate integration capabilities. Cloak does not automatically instrument agents or guard every outgoing tool call.
For evaluation support, email info@traceryx.com with the version and a sanitized error. Do not send credentials or customer trace payloads.