Data safety and retention

Foveus captures telemetry that helps engineering teams understand what happened during an execution. That telemetry can include request context, response context, logs, timings, failure evidence, and searchable context fields. This page explains how Foveus approaches data safety and retention.

Masking redacted query-string parameters and reading MaxBodyCaptureSizeBytes from configuration require Foveus.SDK 1.1.0-beta.18 or later.

What Foveus captures

The exact data captured depends on your SDK configuration. Foveus can capture:

execution metadata
service name
environment
mode
endpoint or operation
request query values
request body context
response body context
exception details
logs, if logging integration is configured
outcome and failure evidence
searchable context fields

What Foveus does not try to be

Foveus is not a long-term raw payload archive. Foveus is designed to help you investigate executions and issues with bounded, useful telemetry. Execution Context Search uses indexed context fields. It does not scan arbitrary raw request or response bodies.

Redaction

The Foveus SDK applies redaction to help protect sensitive fields and headers. Default redacted headers:

Authorization, Cookie, Set-Cookie, X-API-Key, X-Auth-Token, Authentication

Default redacted fields in captured JSON request and response bodies:

password, token, secret, key, creditCard, ssn, email, phone, address,
accessToken, access_token, refreshToken, refresh_token, idToken, id_token,
apiKey, api_key, clientSecret, client_secret, authorization,
cardNumber, cvv, cvc, pin, otp

You can add your own redacted fields.

{
  "Foveus": {
    "ApiKey": "fov_test_...",
    "RedactedFields": ["nationalId", "accountNumber", "dateOfBirth"]
  }
}

How redaction behaves:

Field names match exactly, ignoring case. password is redacted; userPassword is not.
The SDK replaces a redacted string, number, boolean or null value with "***" before sending it. An object or array under a redacted key is not masked.
Bodies are redacted before they are truncated to MaxBodyCaptureSizeBytes (64 KB by default).
A query-string parameter whose name is a redacted field is stored as ***; other parameters are stored as sent. Earlier SDK versions store the whole query string as sent.
Log messages and exception messages are not redacted. Do not log secrets.
Client IP addresses are anonymized by default: the last octet of an IPv4 address, or the last 80 bits of an IPv6 address, is zeroed.

Redaction is a safety layer. Do not intentionally send secrets, credentials, card data, or highly sensitive personal data to Foveus.

Searchable context

Foveus can index safe scalar context fields so you can search for executions by business values. For example:

{
  "customerId": "cus_12345",
  "orderStatus": {
    "value": 1,
    "label": "Confirmed"
  }
}

Foveus can index:

customerId = cus_12345
orderStatus.value = 1
orderStatus.label = Confirmed

Then you can search:

service:orders-api context:customerId="cus_12345"

or:

service:orders-api context:orderStatus.value=1

Searchable context safety

Before context is indexed, Foveus applies safety controls. These can include:

sensitive-key denylist
redaction
scalar-only indexing
bounded key length
bounded value length
bounded traversal depth
maximum indexed properties per execution
allowed context sources
workspace and service policy controls

The backend refuses to index or search keys that are, or contain, any of these words: password, passcode, pin, otp, token, authorization, cookie, secret, apikey, api_key, card, pan, cvv, cvc, bvn, nin. It also refuses values that look like tokens. Redacted values are stored as ***, so the original value cannot be searched. For example, if accountNumber is redacted, this search does not work:

service:orders-api context:accountNumber="1234567890"

Use safer identifiers such as request IDs, customer IDs, transaction IDs, or internal references.

Context sources

Foveus can index context from enabled sources.

Source	Description
`request_query`	Query string values from the request URL. Redacted names are masked with the SDK version noted at the top of this page.
`request_body`	JSON fields sent to your API.
`response_body`	JSON fields returned by your API or provider.
`custom_context`	Values added by your application or SDK configuration.

Response body context is useful when you need to understand what your service or a third-party provider returned. Use redaction, sampling, truncation, and path exclusions to keep capture safe and bounded.

Retention

Execution telemetry is kept for 2 days during private beta. Retention is the same for every workspace; plan-based retention is not implemented yet.

Data	Retention
Executions	2 days
Raw metrics	2 days
Spans	2 days
Raw errors	2 days
Context buffer	2 days
Searchable context properties	2 days
Outcome annotations	2 days
Worker heartbeats	30 days
Alerts	90 days
Email events	90 days
Issues	Not deleted automatically during private beta
Logs	Set by the log store (Loki), not by Foveus

Cleanup runs once a day, so data can be up to a day older than its retention window before it is removed. An Issue keeps its title, counts and status after its executions expire; its list of linked executions only shows the ones still retained.

Production capture guidance

For most production services, start with the Balanced capture profile and explicit redaction.

{
  "Foveus": {
    "ApiKey": "fov_live_...",
    "CaptureProfile": "Balanced",
    "CaptureRequestBodies": true,
    "CaptureResponseBodies": false,
    "ContextSamplingRate": 0.01,
    "ExcludedPathPrefixes": ["/health", "/metrics"],
    "RedactedFields": ["nationalId", "accountNumber", "dateOfBirth"]
  }
}

This lets Foveus capture useful execution evidence while keeping capture bounded. Balanced does not capture response bodies; set CaptureResponseBodies to true only where you need response context. For highly sensitive services, reduce body capture or exclude sensitive routes.

{
  "Foveus": {
    "ApiKey": "fov_live_...",
    "CaptureProfile": "HighThroughput",
    "CaptureRequestBodies": false,
    "CaptureResponseBodies": false,
    "ExcludedPathPrefixes": ["/health", "/metrics", "/auth"]
  }
}

Path exclusions

Use path exclusions to avoid capturing noisy or sensitive routes.

{
  "Foveus": {
    "ApiKey": "fov_live_...",
    "ExcludedPathPrefixes": ["/health", "/metrics", "/auth"]
  }
}

Common exclusions include:

/health
/metrics
/ready
/live
/auth

Sampling

Use ContextSamplingRate to control how often successful context snapshots are captured.

{
  "Foveus": {
    "ApiKey": "fov_live_...",
    "ContextSamplingRate": 0.01
  }
}

A value of 0.01 means 1%. Failed requests always capture context. Sampling helps reduce storage, CPU, and network overhead for high-volume services.

Body size limits

Use MaxBodyCaptureSizeBytes to keep captured payloads bounded. It is read from configuration only with the SDK version noted at the top of this page; earlier versions always use the 64 KB default.

{
  "Foveus": {
    "ApiKey": "fov_live_...",
    "MaxBodyCaptureSizeBytes": 65536
  }
}

Bodies larger than the limit are truncated. Redaction runs before truncation.

Recommended safety checklist

Before sending live telemetry:

Use a live API key. The key decides the mode.
Confirm redacted fields for your domain.
Exclude sensitive or noisy paths.
Confirm response body capture is intentional.
Set sampling for high-volume services.
Check that your logs and exception messages do not contain secrets; they are not redacted.
Trigger a test request.
Open the execution in Foveus.
Confirm sensitive fields are masked, including fields nested inside objects.
Confirm context search only exposes safe values.

Troubleshooting

A sensitive field appears in Foveus

Add the exact field name to RedactedFields. If the value is an object or array, add the names of the sensitive keys inside it. If the value appears in a log or exception message, remove it from the message; log and exception messages are not redacted.

{
  "Foveus": {
    "ApiKey": "fov_test_...",
    "RedactedFields": ["sessionCredential"]
  }
}

Then trigger a new request. Redaction changes apply to newly captured telemetry.

Context search finds a value that should not be searchable

Check whether the field should be added to RedactedFields or blocked by policy. Use a safer identifier for search where possible.

Context search does not find a value

Check that:

the field was captured
the value is scalar
the path was not excluded
the value was not redacted
the value was ingested after context indexing was enabled
the selected time range includes the execution
the context is still retained (searchable context properties are kept for 2 days)

Old executions disappeared

Executions are kept for 2 days during private beta, then deleted. If a newer execution is missing, check the time range and the Test/Live mode, and look for a “Telemetry incomplete” banner in the dashboard. Issues are not deleted automatically, but they only list executions that are still retained.

What to do next

Configure redaction: Redaction
Review SDK options: FoveusOptions
Learn about context search: Execution Context Search
Review API key safety: API keys

Start here

Get started

Core concepts

Guides

SDK

Security and data

API reference

Data safety and retention

What Foveus captures

What Foveus does not try to be

Redaction

Searchable context

Searchable context safety

Context sources

Retention

Production capture guidance

Path exclusions

Sampling

Body size limits

Recommended safety checklist

Troubleshooting

A sensitive field appears in Foveus

Context search finds a value that should not be searchable

Context search does not find a value

Old executions disappeared

What to do next