IP Anonymization for GraphQL Telemetry | Cosmo by WunderGraph - WunderGraph

IP addresses redacted from telemetry by default

The Cosmo Router anonymizes client IP addresses before writing any trace, metric, or log. Choose full redaction for maximum privacy, or one-way hashing for anonymous analytics.

Enabled by default. No configuration required.

The problem

Every telemetry sink is a potential PII leak

IP addresses land in traces, metrics, and logs by default. Most infrastructure is not configured to strip them. Auditors ask where every raw IP ended up.

IP addresses are PII by default

Under GDPR and similar regulations, IP addresses count as personal data. Capturing them in traces, metrics, and logs creates compliance exposure you have to document and justify.

Manual anonymization gets missed

Retrofitting IP redaction across every service, exporter, and log pipeline is error-prone. One unconfigured sink is all it takes to fail an audit.

Inconsistent coverage across services

When each team handles anonymization independently, the guarantees are uneven. The data platform may redact; the router may not. Auditors notice.

Our solution

Privacy enforced at a single control point

Cosmo Router intercepts IP addresses before any telemetry export. One configuration block controls the behavior across traces, metrics, and logs. There is no bypass path.

How anonymization works

  1. The Cosmo Router intercepts every incoming request before any telemetry processing begins.
  2. IP anonymization is applied to the client address using the configured method: redact or hash.
  3. Redact replaces the IP with a placeholder. Hash converts it to a consistent one-way identifier that allows session-level analytics without storing the real address.
  4. The anonymized value is used in all downstream exports: OTEL traces, OTEL metrics, and request logs.
  5. No raw IP address leaves the router process through any telemetry channel.
  6. The default method is redact. One line of YAML switches to hash mode.

Before & After

Before Cosmo With Cosmo
Manual IP redaction in each service and exporter Automatic anonymization at the router, applied before any export
Risk of raw IPs appearing in traces or logs after a config change Privacy enforced at a single control point with no bypass path
Complex configuration for GDPR data minimization Enabled by default with a single one-line override to switch modes
Inconsistent anonymization across distributed services Uniform protection across OTEL traces, metrics, and access logs

Configuration

Redact or hash

compliance:
  anonymize_ip:
    enabled: true
    method: redact # or "hash"

Default is redact. Switch to hash when you need anonymous user session tracking across requests.

How IP anonymization works in Cosmo Router

01

Intercept

The router reads the client IP from the incoming request before any telemetry attribute is written.

02

Anonymize

Redact removes the address entirely, replacing it with a placeholder. Hash applies a one-way function, producing a stable anonymous identifier.

03

Propagate

The anonymized value is attached to OTEL trace spans, metric attributes, and request log lines. The raw address is never written.

04

Audit

Default-on behavior means your telemetry config demonstrates data minimization to auditors without requiring additional controls.

Privacy controls

Built-in, no configuration required

Default-on protection with a single toggle to change modes.

On by default

IP anonymization is enabled in every Cosmo Router deployment. No configuration required for the base protection.

Redact mode

Completely removes the IP address from all telemetry output. Maximum privacy, minimum data.

Hash mode

Converts IP addresses to a consistent one-way hash. Allows anonymous user session analytics while protecting the real address.

Zero latency overhead

Anonymization runs synchronously in the router process, before any I/O. No measurable effect on request latency.

Deploy with IP anonymization on

Start the Cosmo Router with default settings. IP anonymization is already active.

FAQ

IP anonymization on Cosmo Router