Security and data handling
Promptic can process prompts, model outputs, tool arguments, traces, dataset cases, files, and evaluation results. Instrument only data your organization is authorized to process.
This guide explains product behavior; it is not a substitute for your security, privacy, or legal review. Refer to the published Privacy Policy, DPA, Subprocessors, Security, and Terms pages for contractual details.
What tracing captures
Auto-instrumentation can capture:
- model requests and responses;
- span inputs, outputs, and attributes;
- tool names, arguments, and results;
- token counts, model identifiers, cost, timing, and errors;
- custom span attributes added by your application.
Review provider and framework instrumentation in a non-production environment before enabling it for sensitive traffic. Do not attach secrets, authentication headers, database credentials, or unnecessary personal data to spans.
Files and artifacts
Large inline media can be uploaded as artifacts and replaced in trace payloads by a
promptic-artifact:// reference. External HTTPS media URLs remain external URLs.
Local paths are never read automatically. Use promptic_sdk.artifact() only for a file you intend
to upload. Treat screenshots and example files as customer data: check their visible content before
attaching them.
Credentials
- Promptic API keys should be stored in a secrets manager.
- Provider credentials are write-only after saving and are used only for configured model access.
- Custom provider endpoints receive the prompts and inputs sent to those models.
- Browser sessions are for people; use API keys for services and automation.
Retention and deletion
Trace retention and included retained storage depend on plan. Retention enforcement removes data after the configured period; deleting an AI Application or component can affect all subordinate data. Review impact before destructive actions.
Backups, legal retention, billing records, and security logs can have different lifetimes from interactive trace data. Use the contractual documents for exact commitments.
Region and providers
Promptic infrastructure region, model inference region, and third-party provider retention are separate questions. A provider being available in Europe does not by itself guarantee EU-only inference or zero data retention.
For regulated workloads, confirm the exact endpoint, account plan, regional setting, transfer mechanism, and provider guarantee. See Models and providers.
Safe rollout checklist
- Instrument a non-sensitive test workload.
- Inspect the full trace payload and artifacts.
- Remove unnecessary attributes at the source.
- Confirm provider credentials, endpoint, and region.
- Set access roles and separate service keys.
- Confirm retention and billing expectations.
- Enable production traffic gradually and review captured examples.