Agent Analytics privacy modes

An Agent Analytics privacy mode controls whether prompt and response text leaves your infrastructure. There are three modes: full sends message content, metadata_only sends none, and customer_enriched sends none but uses quality labels you compute yourself. Every mode still sends tokens, cost, latency, model names, and session grouping.

Choose the mode before wide rollout, because it determines what your legal review needs to cover. Amplitude recommends full with the AI SDK's default PII redaction. Built-in signals, topics, and LLM evaluators read message text, so the other two modes turn them off.

What each mode sends

Most built-in signals, topics, and prompt-based evaluators read message text. When a session carries no text, Amplitude leaves their results off the [Agent] Session Record rather than guessing. The Data Quality Issues signal and any code evaluators you add still run. Cost, latency, token, error, and model metrics work in every mode. For what each signal reads, refer to Agent Analytics built-in signals.

full

Message content, system prompts, tool inputs and outputs, and score comments all reach Amplitude. Amplitude's built-in enrichment runs and produces the fullest signal set.

• The system prompt is optional, so you can omit it.
• The AI SDK redacts PII by default. It scrubs emails, phone numbers, SSNs, credit card numbers, IP addresses, and base64 images before events leave your process. For the full list of patterns and placeholders, refer to What PII redaction removes.

metadata_only

No message content, system prompts, tool payloads, or score comments leave your process. You still get tokens, cost, latency, model names, and session grouping, so analyses that don't need content still work.

customer_enriched

No content leaves your process, the same as metadata_only. You run your own evaluation on your infrastructure and send the results through trackSessionEnrichment() (Node) or track_session_enrichment() (Python). Amplitude stores those labels on an [Agent] Session Enrichment event as you sent them.

You can send Session Enrichment events in any mode. customer_enriched is the mode where your labels are the main source of session-level quality data, because Amplitude's content-based signals have no text to read. Refer to Provide your own session enrichments.

What PII redaction removes

In full mode, the AI SDK scans every content channel it sends (message text, system prompts, tool inputs and outputs, tool definitions, reasoning content, and score comments) and replaces each match with a fixed placeholder before the event leaves your process. Redaction is on by default: redactPii in Node, and redact_pii in Python from version 1.17.0. The placeholders contain no quotes or backslashes, so they stay valid inside JSON.

Behavior to expect in tests and security reviews:

• Detection is pattern-based. The SDK doesn't run a named-entity model, so it doesn't redact names, street addresses, or dates of birth. Add customRedactionPatterns or customRedactionFn (Node) or custom_redaction_patterns or custom_redaction_fn (Python) for those, or plug in your own scrubber such as Presidio.
• Phone and SSN detection target US formats. International numbers match only in E.164 form with a leading +.
• Code-style :: tokens such as std::vector, a[::2], and ::Module aren't treated as IPv6 addresses.
• Base64 redaction applies to a whole value. The SDK redacts a raw base64 string only when it's longer than 20 characters, a multiple of 4 in length, and contains +, /, or =, so ULIDs, hex tokens, and UUIDs without dashes pass through. A base64 image embedded in a longer sentence stays in place.
• Custom patterns and the custom function run after the built-in patterns. If the custom function throws or returns a non-string, the SDK replaces the whole value with [content redacted].

The redaction source is in the Node SDK. To inspect the redacted request without sending it, turn on review mode in the SDK.

Apply the mode

How you apply the mode depends on your instrumentation path:

• AI SDK (Node, Python): Set contentMode (Node) or content_mode (Python) once on AIConfig. The SDK routes every content-bearing channel through one gate. Refer to Choose a privacy mode in the SDK reference.
• OpenTelemetry: Turn content capture on or off in your OpenTelemetry instrumentation. Refer to Apply your privacy mode.
• HTTP API, Batch, S3, OpenTelemetry, or a warehouse import: Amplitude doesn't scrub content after receipt. redactPii runs only inside a process that loads the AI SDK. Before data leaves your infrastructure, choose pattern masking, metadata only, or your own callback, SQL, or Collector processor. The shared patterns are in the privacy guide and match the table in What PII redaction removes. A Collector replace_pattern rule can approximate the simpler patterns. Exact parity for email, IPv6, and base64 needs that shared function.

Data residency

Agent Analytics runs in Amplitude's US and EU data centers. Send events to the data center that hosts your project. Your privacy mode applies the same way in both.

The AI SDK sends events through a standard Amplitude client. For an EU project, configure that client for the EU and pass it in instead of an API key:

import * as amplitude from "@amplitude/analytics-node";
import { AmplitudeAI } from "@amplitude/ai";

amplitude.init(process.env.AMPLITUDE_AI_API_KEY!, { serverZone: "EU" });
const ai = new AmplitudeAI({ amplitude });