# PII & Privacy

Protect sensitive data with masking and safe integration patterns.

Brizz is designed for production telemetry, where data privacy is paramount. We provide **privacy-by-default** patterns to ensure sensitive data is handled correctly.

## Golden Rules

1. **Server-Side Only**: Never use your Brizz API key in client-side code (browsers, mobile apps). Always send telemetry from a trusted server environment.
2. **Mask Sensitive Data**: Use our built-in masking to redact PII (Personally Identifiable Information) and secrets before they leave your infrastructure.
3. **Least Privilege**: Rotate API keys regularly and restrict access to your Brizz organization.

## Built-in Masking

Both SDKs include a powerful masking engine that can automatically detect and redact common sensitive data patterns.

:::tabs
:::tab[Python]
Enable default masking rules:

```python
import os
from brizz import Brizz

Brizz.initialize(
    api_key=os.environ.get("BRIZZ_API_KEY"),
    app_name="my-ai-app",
    masking=True,  # Enables default PII patterns (email, phone, SSN, etc.)
)
```

Configure custom masking rules:

```python
from brizz import Brizz, MaskingConfig, SpanMaskingConfig, AttributesMaskingRule

Brizz.initialize(
    api_key=os.environ.get("BRIZZ_API_KEY"),
    masking=MaskingConfig(
        span_masking=SpanMaskingConfig(
            rules=[
                AttributesMaskingRule(
                    attribute_pattern=r"gen_ai\.(prompt|completion)",
                    mode="partial",
                    patterns=[r"sk-[a-zA-Z0-9]{32,}"], # Mask API keys
                ),
            ],
        ),
    ),
)
```
:::tab[Node.js]
```typescript
import { Brizz } from '@brizz/sdk';

Brizz.initialize({
  apiKey: process.env.BRIZZ_API_KEY,
  appName: 'my-ai-app',
  masking: {
    spanMasking: {
      rules: [
        {
          attributePattern: 'gen_ai\\.(prompt|completion)',
          mode: 'partial',
          patterns: ['sk-[a-zA-Z0-9]{32,}'], // Mask API keys
        },
      ],
    },
  },
});
```
:::

## What Should You Mask?

Common candidates for masking include:

- **API Keys & Secrets**: OpenAI keys, database credentials, etc.
- **PII**: Email addresses, phone numbers, social security numbers.
- **Customer Identifiers**: Internal IDs that shouldn't be exposed.
- **Raw Content**: If your compliance policy requires it, you may need to mask the raw prompts and completions.

:::info
Masking strategy depends on your product. Some teams mask prompts/completions entirely; others keep them for debugging but mask specific entities.
:::

## See also

- [Python SDK reference](/docs/sdks/python.md) and [Node.js / TypeScript SDK reference](/docs/sdks/typescript.md) — full masking configuration options.
- [API keys](/docs/admin/api-keys.md) — rotate keys and follow least-privilege.
- [Issues](/docs/platform/issues.md) — repeated PII detections roll up here as content issues.
- [Mute messages](/docs/instrument/mute.md) — drop a call's content entirely instead of masking parts of a turn, including tool arguments and results on their own.