Skip to content

Security and data controls

You decide how much of your content reaches Anosys. From least to most data sent:

%%{init: {"flowchart": {"curve": "linear"}}}%%
graph LR
    A["Metadata only<br/>no prompts or responses"] --> B["Redacted content<br/>replaced before sending"]
    B --> C["Encrypted content<br/>only you can read it"]
    C --> D["Full content"]

Send metadata only

Source Setting
Claude Code, Codex, Antigravity hooks Install with --redaction (or set REDACTION=true). Prompts, responses, code and tool output are replaced before they leave the machine. Tokens, cost, timing and structure are kept.
Anthropic SDK, Claude Agent SDK capture_content=False (captureContent: false in JavaScript)
OpenAI Agents SDK capture_inputs=False, capture_outputs=False
Your own events Only send the fields you need

Encrypt content with your own passphrase

If you need the content for debugging but don't want it readable by anyone without your key, the Anosys SDKs and hooks can encrypt content fields on your machine before sending them.

%%{init: {"flowchart": {"curve": "linear"}}}%%
graph LR
    A["Your app or machine<br/>ANOSYS_ENCRYPTION_KEY"] -->|"encrypted fields"| B["Anosys"]
    B -->|"encrypted fields"| C["Your browser<br/>decrypts with your key"]

Step 1. Set a passphrase where data is sent from

1
export ANOSYS_ENCRYPTION_KEY="a long passphrase only your team knows"

Set it in the environment of your app, or in the hook's settings for Claude Code and Codex. In Python, also install the cryptography package.

By default, the fields that carry content are encrypted: prompts, responses, system instructions, input and output messages, and tool results. To choose the fields yourself, list them in ANOSYS_ENCRYPTED_COLUMNS (comma-separated).

Step 2. Read encrypted data in the console

  1. Open your account settings and go to the Decryption tab.
  2. Enter the same passphrase as the Decryption Key.
  3. Choose Smart Decryption (Recommended), or General Decryption (Full Scan) if some encrypted fields aren't being picked up.

The key is kept in your browser and used there to decrypt what you view. Anyone without the passphrase sees only encrypted text.

Keep the passphrase safe

Anosys can't recover it. If you lose it, data encrypted with it can't be read. Encrypted fields also can't be searched, charted or used by the AI Assistant, so encrypt only what needs it.

To encrypt values in your own code without the SDK, Collecting → Data Encryption has example code for Python and JavaScript.

Website visitors

The website tracker respects consent from common consent managers, Do Not Track and Global Privacy Control, never records what visitors type into forms, and removes email addresses from click labels. You remain responsible for your own cookie notice and privacy policy.

Catch sensitive data automatically

In Data Processing → Alert Builder, use the ready-made pattern rules (email addresses, credit card numbers, US Social Security numbers) to be alerted when sensitive data shows up in prompts or responses. See Alerts.

Keys and access

  • Keep API keys on servers and in environment variables, never in browser code. Browser code should use the tracker or an unauthorized endpoint URL, which can send data but can't read it.
  • Create separate API keys per service so you can revoke one without affecting the others (Collecting → Integration Options → API).
  • Invite teammates under Settings → Users, and remove people who leave.
  • All data is sent to Anosys over HTTPS.

Questions about security or compliance

For security reviews, questionnaires or data-processing agreements, email support@anosys.ai.