# Data Scrubbing

Sentry has a server-side data scrubbing feature to protect sensitive information from malicious actors. The feature is enabled by default and recommended to be used. It offers default scrubbing rules and you can also add custom rules to scrub additional data. These privacy rules can be configured at the project level for individual applications or at the organization level to apply the same rules across all projects.

## Data Scrubbing

### Setting Page Location

Data scrubbing settings can be found by following these steps:

1. Go to **Sidebar > Settings > Projects** and select the project.

<figure><img src="https://2275014547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl9KB7mDeg58CszyWm4TI%2Fuploads%2FLEd8B9nKwBhnT9Tx1LKr%2Fimage.png?alt=media&#x26;token=330f71d3-5196-454a-a7ec-76b7989fbb1e" alt=""><figcaption></figcaption></figure>

2. Go to **Sidebar > Privacy and Security** to open the Data Scrubbing settings.

<figure><img src="https://2275014547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl9KB7mDeg58CszyWm4TI%2Fuploads%2FjIZGq3vOGmO0mNVpiIIz%2Fimage.png?alt=media&#x26;token=eced67a2-47ba-4191-ba6d-29f1aa01fa0a" alt=""><figcaption></figcaption></figure>

### Scrubbing Rules

Sentry has a default scrubbing rules and you can add more custom rules to scrub sensitive data. These are the Sentry scrubbing rules:

1. Credit card number value, detected using regex patterns.
2. Span fields with sensitive keys, all values are redacted when the field name matches:
   1. password
   2. secret
   3. passwd
   4. api\_key
   5. apikey
   6. auth
   7. credentials
   8. mysql\_pwd
   9. privatekey
   10. private\_key
   11. token
   12. bearer
3. Span fields and values specified on settings. To set it, open the Data Scrubbing setting page and add the fields name or values to **Additional Sensitive Fields** field. Separate each value by a newline.

   <figure><img src="https://2275014547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl9KB7mDeg58CszyWm4TI%2Fuploads%2FEDm9ICFbi95SabBFOeOB%2Fimage.png?alt=media&#x26;token=47783a88-606d-466a-b14b-d50519cc4bde" alt=""><figcaption></figcaption></figure>
4. Advance data scrubbing rules. You can specify what fields and condition the rule will be applied. To set it, follow these steps:
   1. Open the Data Scrubbing setting page.

   2. Look for **Advanced Data Scrubbing** table and click **Add Rule** button. it will open the rules form.

      <figure><img src="https://2275014547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl9KB7mDeg58CszyWm4TI%2Fuploads%2FYXLVb70VOPsLVcp4bcMb%2Fimage.png?alt=media&#x26;token=6c4e7be1-c0b7-4779-8207-f3be216d4d45" alt="" width="480"><figcaption></figcaption></figure>

   3. Choose the method, what will the redacted value converted to.

      <figure><img src="https://2275014547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl9KB7mDeg58CszyWm4TI%2Fuploads%2F4XDuZl8PGdkGshc13S9Q%2Fimage.png?alt=media&#x26;token=ef32b1aa-e889-45bb-b6cb-7b7dff1f60b8" alt="" width="420"><figcaption></figcaption></figure>

   4. Choose the data type. If the data type is matched with the value, it will be redacted. Choose **Anything** to always redact the field value.

      <figure><img src="https://2275014547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl9KB7mDeg58CszyWm4TI%2Fuploads%2FdD4QZ4xOTHfWo7l8GCrf%2Fimage.png?alt=media&#x26;token=2795e818-6411-4378-bbc6-cd41688ce1cb" alt=""><figcaption></figcaption></figure>

   5. Choose the field. To make it simple inserting the field names, find a trace that contains the field on any spans and copy the trace transaction ID. Then click on **Use event ID for auto-completion**, it will open a form to search fields based on the trace transaction ID. &#x20;

      <figure><img src="https://2275014547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl9KB7mDeg58CszyWm4TI%2Fuploads%2FogkTL5WiUrncQwBwJ8vX%2Fimage.png?alt=media&#x26;token=61b2623f-3331-4972-a841-9a8c50e920ca" alt=""><figcaption></figcaption></figure>

   6. Verify the specified field according to the scrubbing rules on new incoming traces. The data should be redacted if the rules are fulfilled.
