What Data Is Captured

See exactly which fields ArmorIQ records in each capture mode, which fields are never recorded, and what leaves your network when you export traces.

This page is for security teams, administrators, and developers who must know what trace data contains. You get one table of what each capture mode records, a list of data that is always removed, and the rules for data that leaves ArmorIQ.

The four capture modes

Your organization sets one capture mode. It controls how much data ArmorIQ keeps from new traces. An administrator changes it in Settings > Observability. See Organization controls.

Mode	Plain meaning
`off`	ArmorIQ keeps no new trace data.
`metadata`	ArmorIQ keeps the shape of the run, policy decisions, status, timing, token counts, and safe error types. It keeps no prompts, no completions, and no tool inputs or outputs. This is the default.
`enhanced`	Same as `metadata`, plus short, redacted summaries of prompts, completions, tool arguments, and tool results. The organization must also allow content capture.
`debug`	Same as `enhanced`, with larger limits. It is temporary. It ends by itself within 24 hours.

A mode in an SDK or in a narrower scope can only lower the data you keep. It can never raise it above the organization setting.

What each mode records

Data	`off`	`metadata`	`enhanced`	`debug`
Any new trace or span	No	Yes	Yes	Yes
Trace and span IDs, parent links, span names, start and end times, status	No	Yes	Yes	Yes
Session ID, agent ID, conversation ID, workflow ID, ticket ID	No	Yes	Yes	Yes
Policy decision, policy ID and name, policy version, rule ID, reason code, enforcement action, policy source	No	Yes	Yes	Yes
Model name, model provider, input tokens, output tokens, cache tokens	No	Yes	Yes	Yes
Cost (ArmorIQ computes it at ingest from its own price catalog and ignores a cost that an SDK sends)	No	Yes	Yes	Yes
Tool name, tool type, MCP server name, tool call ID, operation category (tool, MCP, Bash, CLI, command, approval, delegation)	No	Yes	Yes	Yes
For Bash and CLI work: executable name only, exit code, retry count, timeout and killed flags, size of standard output and standard error	No	Yes	Yes	Yes
Error type (the class name) and a short error code	No	Yes	Yes	Yes
Prompt text and model output text	No	No	Yes, redacted and bounded	Yes, redacted and bounded
Tool arguments and tool results	No	No	Yes, redacted and bounded	Yes, redacted and bounded
Error message summary (no stack trace)	No	No	Yes, redacted and bounded	Yes, redacted and bounded
Size limit for each content field	None	None	2 KiB from the SDK	8 KiB from the SDK
How long the mode lasts	Until changed	Until changed	Until changed	Up to 24 hours, then it returns to `metadata`

Three rules decide whether content is stored in enhanced and debug. All three must be true:

The organization mode is enhanced or debug.
The organization allows content capture. If it does not, the effective mode is metadata, even when the mode says enhanced or debug.
For debug, the debug window has not ended.

Bash and CLI work has no field for the command text. Only the executable name is stored as a field. The command text can reach storage only as part of tool arguments or tool results, and only in enhanced or debug.

ArmorIQ also stamps each stored span with the capture mode and policy revision that applied to it.

Fields that are always forbidden

These rules apply in every mode. The SDK removes this data before it exports a span. The ArmorIQ backend removes it again when it receives a span, and the backend applies the full list below. Nobody can switch secret capture on.

Category	Examples that are removed
Credentials and secrets	API keys and tokens that start with `ak_`, `sk_`, `pk_`, `rk_`, `ghp_`, `gho_`, `ghu_`, `ghs_`, `ghr_`, `github_pat_`, `xox` (Slack), `AIza` (Google), `AKIA` or `ASIA` (AWS); JWTs; `Bearer` tokens; private key blocks (`-----BEGIN`); long random strings that mix letters and digits; text such as `password=`, `api_key:`, `authorization:`, or `cookie:` followed by a value
Authentication headers and cookies	Any attribute or object key that names an API key, authorization, bearer token, cookie, credential, password, secret, private key, token, signature, or session ID has its value removed or replaced
Personal identifiers	Email addresses; US Social Security numbers and EINs; India PAN numbers; payment card numbers that pass the Luhn check; phone-like numbers
Other sensitive text	Statements of student grades
Stack traces and raw error bodies	Only the error type and a bounded message summary are kept
Producer-supplied authority fields	The backend drops cost, timing-trust, and pricing-source values that an SDK sends, and computes its own
Any attribute that is not on the ArmorIQ allow-list	The backend drops it. It does not reject the span.

When a value contains a forbidden match, ArmorIQ replaces the whole value with a marker such as [REDACTED] or [REDACTED:CREDENTIAL]. It does not cut out only the match. One match anywhere in a prompt or a tool argument replaces that whole content field.

Redaction is pattern based. It cannot find a secret that matches none of the patterns, for example a password written in plain words inside a prompt. Do not place secrets in prompts or tool arguments.

How content is bounded

Content is redacted first and cut to size second.
The SDK limits each content field to 2 KiB in enhanced and 8 KiB in debug. It also limits nesting depth (4 and 8), items in a list (20 and 100), and the length of one string (512 and 2,048 characters).
ArmorIQ then keeps at most 4,096 bytes of each content field when it stores the span.
Text that is cut gets a [TRUNCATED] marker, and the span carries armoriq.content.truncated.
Text fields that are not content (such as names and labels) are limited to 256 characters.

Why a content field can be empty

When content is missing, the span says why. The span has a state for each content field, and a reason code:

Reason code	Meaning
`captured`	The content was recorded.
`capture_mode_off`	The organization mode is `off`.
`capture_mode_metadata`	The mode is `metadata`, which records no content.
`organization_content_disabled`	The mode allows content, but the organization has not allowed content capture.
`external_content_disabled`	You export to an external destination, and the organization has not allowed external content.
`policy_expired`	The debug window or the policy lease ended.
`policy_unavailable`	The SDK could not read the organization policy, so it kept no content.
`not_provided_by_adapter`	The framework did not give the SDK this content, for example because no goal was passed.

What leaves ArmorIQ when you export

If you choose external or provider in Choose who exports your traces, spans go to a system that ArmorIQ does not control.

Your ArmorIQ API key never goes to an external destination.
Content leaves only when all of these are true: the effective mode is enhanced or debug; the organization allows content capture; the organization also allows external content capture; and the SDK holds a current organization policy. If any one is false, the SDK exports metadata only.
A provider that you own never receives content. In provider mode the SDK limits capture to metadata.
The TypeScript SDK exports only an allow-list of attributes. The list covers the trace structure, safe model and token attributes, and the IDs that link spans (such as the tool call ID and the plan item ID). Values that contain a credential, an email address, or a phone-like, SSN-like, or card-like number are dropped.
The Python SDK does not use an allow-list. It removes ArmorIQ content keys and applies the same redaction. Its spans still carry ArmorIQ IDs such as armoriq.session_id and armoriq.agent_id to the external destination.
Resource attributes such as service.name are cleaned before export. Do not put secrets or user content in them.

Data that you export is outside ArmorIQ access control. The destination has its own access rules. ArmorIQ cannot take back data after it leaves. See What the dashboard Off setting does.