Redaction

Redaction removes secrets and personal data from what Golem keeps about a call. It runs in the Golem agent on the machine, before the payload is hashed, signed, stored in your bucket or indexed for search, so the stored copy never held the value. The signed record still verifies, and it can still prove what the original was if you hold it.

Turn it on#

Redaction is set per profile, in the console under Protections → Profiles → your profile → Redaction:

1. Set Redaction to On. It is off until you do.
2. Attach the redaction packs you want. Golem ships three, below; you can attach several, and a machine removes everything named by every pack on every profile that reaches it.
3. Choose what Writes in place of a match:

Separately, Secrets in tool arguments is on by default. It replaces the types in Secrets and keys in the copy of each call's arguments sent to Golem with a short hash, even when Redaction is off. An owner or admin can make it a workspace minimum so no profile can turn it off. The arguments of a call held for a person's decision are always scrubbed this way.

What it finds#

Golem's packs are read-only and kept up to date. To change one, use Make our own copy to change and attach the copy instead.

Secrets are found by the shape each issuer gives its keys, not by guessing at anything that looks random, and obvious placeholders such as example or changeme are left alone. A pack you build yourself can also name account numbers, tax numbers, organisation names, usernames and passwords written in plain text, which the model relay finds.

Your own patterns#

Under Protections → Packs → Redaction packs, Your patterns → New pattern adds a pattern for something only your organization has, such as a badge or customer number. Give it a name ("What it finds") and an RE2 regular expression, and try it in Try it on some text, which counts the matches as you type. Apply it now makes it act; leave it off to save it without applying it.

The console's match count runs in your browser and can differ slightly from RE2 for unusual patterns. An agent connected to Golem's MCP can check a pattern exactly as the Golem agent will, with test_redaction_rule: it reports whether the pattern compiles, the spans it matches in your sample text (up to 8 KB) and the sample after redaction, and saves nothing.

The model relay#

Names and addresses have no fixed shape, so a pattern cannot find them. For those, the Golem agent sends the text to the model relay, which runs two small open models, one for names, places and organisations and one for personal details such as addresses and dates of birth, and returns where they are. The Golem agent then redacts the text itself.

• Golem Cloud's relay runs the models only if an owner or admin sets Golem's models may read our agents' traffic to Allowed, under Protections → Settings → Golem Cloud's relay. It is Not allowed by default.
• Your own relay. You can run a full relay in your own cloud instead, from Deploy → Relays → Deploy a full relay, and point a profile at it. Then the text never reaches Golem for this.

Either way, the profile must have Redaction on and carry a pack that names a model type.

A call to the relay adds about 140 ms. If the relay cannot be reached, answers with an error, or the text is over 100 KB, the model step is skipped and only the on-machine patterns apply. Redaction does not wait or fail closed on the relay.

How the record still verifies#

The record signs a hash of the payload that was stored, which is the redacted one, so anyone can check the stored copy against the record without seeing what was removed. When redaction changed a payload, the signed entry also carries a SHA-256 of the original. If you hold the original, for example from the machine it came from, you can show it is exactly what the agent sent. Each entry also notes which types were removed and how many of each, never the values. See The signed record for how entries are checked.

What is not redacted#

• Traffic to the model provider. Golem redacts what it stores. Prompts and responses passing through its provider proxies reach Anthropic, OpenAI or Google as the agent sent them.
• What the agent itself reads. A tool result reaches the agent unchanged, except for MCP results passing through Golem's gateway, which are redacted before the agent sees them when the profile's Redaction is on.
• The facts of a call. Session, machine, agent, MCP server and tool names, and the times are never redacted: they are what the record is for. Write a pattern for something sensitive in a repository or file path, not a tool name.
• Large fields. A field over 1 MiB is not scanned. It is stored as written and kept out of search.
• Some sources. The SDKs redact before they sign, from the machine's policy. The browser extension does not redact personal data.
• Telemetry. Token counts, costs and timings carry no content and are not scanned.
• The prompt-injection check. It sends the text it scores to the relay unredacted, and neither the relay nor Golem stores it.

Messages between agents follow the profile's Redaction setting. The posture and config scan never sends a credential's value: a plaintext secret in an MCP server's settings is reported by the variable's name.

For where the stored copy lives and who can read it, see Where your data goes.