# Redaction

> Mask secrets and personal data on the machine before anything is stored, and keep the record verifiable.

Redaction removes secrets and personal data from what Golem keeps about a call. It runs in the Golem agent on the machine, before the payload is hashed, signed, stored in your bucket or indexed for search, so the stored copy never held the value. The signed record still verifies, and it can still prove what the original was if you hold it.

## Turn it on

Redaction is set per profile, in the console under **Protections** → **Profiles** → your profile → **Redaction**:

1. Set **Redaction** to **On**. It is off until you do.
2. Attach the redaction packs you want. Golem ships three, below; you can attach several, and a machine removes everything named by every pack on every profile that reaches it.
3. Choose what **Writes in place of a match**:

| Choice | A matched email becomes |
|---|---|
| `<TYPE>` (the default) | `<EMAIL_ADDRESS>` |
| `****` | `****` |
| Hash | a SHA-256 of the value, so the same value always looks the same |
| Nothing | the value is removed |

Separately, **Secrets in tool arguments** is on by default. It replaces the types in **Secrets and keys** in the copy of each call's arguments sent to Golem with a short hash, even when Redaction is off. An owner or admin can make it a workspace minimum so no profile can turn it off. The arguments of a call held for a person's decision are always scrubbed this way.

## What it finds

Golem's packs are read-only and kept up to date. To change one, use **Make our own copy to change** and attach the copy instead.

| Pack | What it removes | Found by |
|---|---|---|
| Contact & financial | Email addresses, phone numbers, US social security numbers, card numbers (checked with the card checksum), IBANs (checksum checked), crypto wallet addresses, IP addresses | the Golem agent, on the machine |
| Secrets and keys | AWS access keys; GitHub, GitLab, Slack, npm, Hugging Face and Golem tokens; Anthropic, OpenAI, Google and Stripe keys; private keys; JWTs; bearer tokens; passwords in database URLs; and other secrets written as `api_key=`, `token:` or `password=` followed by a long value | the Golem agent, on the machine |
| Names & addresses | People's names, places, street addresses, ZIP codes, dates of birth, driver's licence and ID numbers | the model relay |

Secrets are found by the shape each issuer gives its keys, not by guessing at anything that looks random, and obvious placeholders such as `example` or `changeme` are left alone. A pack you build yourself can also name account numbers, tax numbers, organisation names, usernames and passwords written in plain text, which the model relay finds.

### Your own patterns

Under **Protections** → **Packs** → **Redaction packs**, **Your patterns** → **New pattern** adds a pattern for something only your organization has, such as a badge or customer number. Give it a name ("What it finds") and an RE2 regular expression, and try it in **Try it on some text**, which counts the matches as you type. **Apply it now** makes it act; leave it off to save it without applying it.

> [!WARNING]
> Once applied, your pattern acts on every machine in the workspace, whether or not a profile's Redaction is on. Test it on real text before you apply it.

The console's match count runs in your browser and can differ slightly from RE2 for unusual patterns. An agent connected to Golem's MCP can check a pattern exactly as the Golem agent will, with `test_redaction_rule`: it reports whether the pattern compiles, the spans it matches in your sample text (up to 8 KB) and the sample after redaction, and saves nothing.

## The model relay

Names and addresses have no fixed shape, so a pattern cannot find them. For those, the Golem agent sends the text to the model relay, which runs two small open models, one for names, places and organisations and one for personal details such as addresses and dates of birth, and returns where they are. The Golem agent then redacts the text itself.

- **Golem Cloud's relay** runs the models only if an owner or admin sets **Golem's models may read our agents' traffic** to **Allowed**, under **Protections** → **Settings** → **Golem Cloud's relay**. It is **Not allowed** by default.
- **Your own relay.** You can run a full relay in your own cloud instead, from **Deploy** → **Relays** → **Deploy a full relay**, and point a profile at it. Then the text never reaches Golem for this.

Either way, the profile must have Redaction on and carry a pack that names a model type.

A call to the relay adds about 140 ms. If the relay cannot be reached, answers with an error, or the text is over 100 KB, the model step is skipped and only the on-machine patterns apply. Redaction does not wait or fail closed on the relay.

## How the record still verifies

The record signs a hash of the payload that was stored, which is the redacted one, so anyone can check the stored copy against the record without seeing what was removed. When redaction changed a payload, the signed entry also carries a SHA-256 of the original. If you hold the original, for example from the machine it came from, you can show it is exactly what the agent sent. Each entry also notes which types were removed and how many of each, never the values. See [The signed record](/record) for how entries are checked.

## What is not redacted

- **Traffic to the model provider.** Golem redacts what it stores. Prompts and responses passing through its provider proxies reach Anthropic, OpenAI or Google as the agent sent them.
- **What the agent itself reads.** A tool result reaches the agent unchanged, except for MCP results passing through Golem's gateway, which are redacted before the agent sees them when the profile's Redaction is on.
- **The facts of a call.** Session, machine, agent, MCP server and tool names, and the times are never redacted: they are what the record is for. Write a pattern for something sensitive in a repository or file path, not a tool name.
- **Large fields.** A field over 1 MiB is not scanned. It is stored as written and kept out of search.
- **Some sources.** The SDKs redact before they sign, from the machine's policy. The browser extension does not redact personal data.
- **Telemetry.** Token counts, costs and timings carry no content and are not scanned.
- **The prompt-injection check.** It sends the text it scores to the relay unredacted, and neither the relay nor Golem stores it.

Messages between agents follow the profile's Redaction setting. The posture and config scan never sends a credential's value: a plaintext secret in an MCP server's settings is reported by the variable's name.

For where the stored copy lives and who can read it, see [Where your data goes](/data).