Security & privacy
Unravel sees the inside of your application, so the SDK is built to leave sensitive data on your server.
Scrubbing happens before the wire
Secret scrubbing and payload truncation run inside the SDK, on your server, before anything is transmitted.
- Secret scrubbing. Values under secret-looking keys (authorization
headers, API keys, tokens, cookies, passwords, …) are redacted from captured
data before it leaves your server. One exception: positional SQL bindings
have no key names to match on. On arrival, the backend checks their SQL
statement for secret-like identifiers. If it finds one, every binding for
that statement is replaced with
[scrubbed]before storage. Other queries keep their bindings because those runtime values are part of the debugger. - Truncation. Oversized runtime values are truncated to a safe limit (64KB) so a large payload can't be exfiltrated through telemetry.
Both apply only to runtime user data: request bodies, query bindings, cache values, job payloads. They never touch developer-written identifiers like SQL text, cache keys, class names, or log messages, which you need verbatim to debug.
Client-side payload encryption (coming)
Client-key payload encryption is coming to selected plans: sensitive payloads will be encrypted with a key only you hold, so even Unravel cannot read them. The dashboard will show the structure, and the values will decrypt only in your browser. It is not available yet.
Transport and storage
All data travels over TLS. Ingest is authenticated with per-project keys that you can revoke and rotate at any time from the dashboard.
Your responsibility
Scrubbing covers known secret-shaped keys, not everything, and the deny-list is fixed in this release (a configurable per-project scrub list is planned). You remain responsible for what your application sends; don't transmit data you aren't permitted to.
Data handling
Telemetry is retained for your plan's window and then deleted. For details on what we collect and your rights, see the Privacy policy.