Agent Analytics privacy modes

An Agent Analytics privacy mode controls whether prompt and response text leaves your infrastructure. There are three modes: full sends message content, metadata_only sends none, and customer_enriched sends none but uses quality labels you compute yourself. Every mode still sends tokens, cost, latency, model names, and session grouping.

Choose the mode before wide rollout, because it determines what your legal review needs to cover. Amplitude recommends full with the AI SDK's default PII redaction. Built-in signals, topics, and LLM evaluators read message text, so the other two modes turn them off.

What each mode sends

Experiment keys, variants, and providers are identifiers, not content, so every mode sends them and PII redaction doesn't scrub them. Use flag and variant names, never user data.

Most built-in signals, topics, and prompt-based evaluators read message text. When a session carries no text, Amplitude leaves their results off the [Agent] Session Record rather than guessing. The Data Quality Issues signal and any code evaluators you add still run. Cost, latency, token, error, and model metrics work in every mode. For what each signal reads, refer to Agent Analytics built-in signals.

full

Message content, system prompts, tool inputs and outputs, and score comments all reach Amplitude. Amplitude's built-in enrichment runs and produces the fullest signal set.

• The system prompt is optional, so you can omit it.
• The AI SDK redacts PII by default. It scrubs emails, phone numbers, SSNs, credit card numbers, IP addresses, and base64 images before events leave your process. For the full list of patterns and placeholders, refer to What PII redaction removes.

metadata_only

No message content, system prompts, tool payloads, or score comments leave your process. You still get tokens, cost, latency, model names, and session grouping, so analyses that don't need content still work.

customer_enriched

No content leaves your process, the same as metadata_only. You run your own evaluation on your infrastructure and send the results through trackSessionEnrichment() (Node) or track_session_enrichment() (Python). Amplitude stores those labels on an [Agent] Session Enrichment event as you sent them.

You can send Session Enrichment events in any mode. customer_enriched is the mode where your labels are the main source of session-level quality data, because Amplitude's content-based signals have no text to read. Refer to Provide your own session enrichments.

What PII redaction removes

In full mode, the AI SDK scans every content channel it sends (message text, system prompts, tool inputs and outputs, tool definitions, reasoning content, and score comments) and replaces each match with a fixed placeholder before the event leaves your process. Redaction is on by default: redactPii in Node, and redact_pii in Python from version 1.17.0. The placeholders contain no quotes or backslashes, so they stay valid inside JSON.

Behavior to expect in tests and security reviews:

• Detection is pattern-based. The SDK doesn't run a named-entity model, so it doesn't redact names, street addresses, or dates of birth. Add customRedactionPatterns or customRedactionFn (Node) or custom_redaction_patterns or custom_redaction_fn (Python) for those, or plug in your own scrubber such as Presidio.
• Phone and SSN detection target US formats. International numbers match only in E.164 form with a leading +.
• Code-style :: tokens such as std::vector, a[::2], and ::Module aren't treated as IPv6 addresses.
• Base64 redaction applies to a whole value. The SDK redacts a raw base64 string only when it's longer than 20 characters, a multiple of 4 in length, and contains +, /, or =, so ULIDs, hex tokens, and UUIDs without dashes pass through. A base64 image embedded in a longer sentence stays in place.
• Custom patterns and the custom function run after the built-in patterns. If the custom function throws or returns a non-string, the SDK replaces the whole value with [content redacted].

The redaction source is in the Node SDK. To inspect the redacted request without sending it, turn on review mode in the SDK.

Voice recordings

A voice agent can attach a call recording URL to a turn. Agent Analytics never receives call audio from the SDK. It stores the URL as an attachment reference and never fetches it.

• The URL ships only in full mode, like other attachment content. In metadata_only and customer_enriched, Amplitude records only that the turn has an attachment and its type.
• PII redaction runs on the URL. A path segment or query value that matches a pattern above, such as 10 consecutive digits, is replaced, and the link no longer plays. Use recording IDs that don't look like phone numbers.
• A signed link expires, and until then anyone holding it can play the call. For a durable reference, pass a URL your own access controls protect, such as your CDN or a host reachable only on your VPN.

For how to attach a recording, refer to Attach the call recording.

User identity in agent-to-agent calls

Privacy modes govern what reaches Amplitude. A separate setting governs what your agent tells another agent about the end user when it calls that agent over A2A, Agent Client Protocol (ACP), or HTTP. The AI SDK has three identity modes for that agent context:

A receiver uses a user ID only from a context whose signature it verifies. An untrusted receiver drops it. For the wire format, refer to Identity modes.

The SDK's provider wrappers can also send x-amplitude-* headers to the LLM provider when you turn on context propagation. Those headers never carry a user ID.

Pairwise IDs and deletion

The SDK derives a pairwise ID from the user ID, the recipient, and a secret salt with HMAC-SHA256. Each counterparty sees a different, stable ID that it can't reverse or match against another counterparty's ID. Configure salts in AMPLITUDE_AI_PAIRWISE_SALTS as a JSON object of version to salt. The SDK mints IDs with the highest version.

• Pairwise IDs are personal data. They're pseudonymous, not anonymous: you can recompute them from the user ID. Include them in your data inventory and in your agreements with counterparties.
• Deletion requests cover them. When a user asks you to delete their data, recompute the pairwise ID for each counterparty you sent one to, and pass those IDs on under your agreements with those counterparties. The SDK doesn't forward deletion requests to other agents.
• Salt rotation resets continuity. A new salt version changes every pairwise ID, so counterparties stop recognizing returning users. The version prefix (pw1_, pw2_) makes the change visible. Rotate deliberately, and keep old salts as long as you need to recompute old IDs for deletion.

Apply the mode

How you apply the mode depends on your instrumentation path:

• AI SDK (Node, Python): Set contentMode (Node) or content_mode (Python) once on AIConfig. The SDK routes every content-bearing channel through one gate. Refer to Choose a privacy mode in the SDK reference.
• OpenTelemetry: Turn content capture on or off in your OpenTelemetry instrumentation. Refer to Apply your privacy mode.
• HTTP API, Batch, S3, OpenTelemetry, or a warehouse import: Amplitude doesn't scrub content after receipt. redactPii runs only inside a process that loads the AI SDK. Before data leaves your infrastructure, choose pattern masking, metadata only, or your own callback, SQL, or Collector processor. The shared patterns are in the privacy guide and match the table in What PII redaction removes. A Collector replace_pattern rule can approximate the simpler patterns. Exact parity for email, IPv6, and base64 needs that shared function.

Data residency

Agent Analytics runs in Amplitude's US and EU data centers. Send events to the data center that hosts your project. Your privacy mode applies the same way in both.

The AI SDK sends events through a standard Amplitude client. For an EU project, configure that client for the EU and pass it in instead of an API key:

import * as amplitude from "@amplitude/analytics-node";
import { AmplitudeAI } from "@amplitude/ai";

amplitude.init(process.env.AMPLITUDE_AI_API_KEY!, { serverZone: "EU" });
const ai = new AmplitudeAI({ amplitude });