# IP addresses redacted from telemetry by default

The Cosmo Router anonymizes client IP addresses before writing any trace, metric, or log. Choose full redaction for maximum privacy, or one-way hashing for anonymous analytics.

Enabled by default. No configuration required.

## The problem

### Every telemetry sink is a potential PII leak

IP addresses land in traces, metrics, and logs by default. Most infrastructure is not configured to strip them. Auditors ask where every raw IP ended up.

### IP addresses are PII by default

Under GDPR and similar regulations, IP addresses count as personal data. Capturing them in traces, metrics, and logs creates compliance exposure you have to document and justify.

### Manual anonymization gets missed

Retrofitting IP redaction across every service, exporter, and log pipeline is error-prone. One unconfigured sink is all it takes to fail an audit.

### Inconsistent coverage across services

When each team handles anonymization independently, the guarantees are uneven. The data platform may redact; the router may not. Auditors notice.

## Our solution

### Privacy enforced at a single control point

Cosmo Router intercepts IP addresses before any telemetry export. One configuration block controls the behavior across traces, metrics, and logs. There is no bypass path.

### How anonymization works

1. The Cosmo Router intercepts every incoming request before any telemetry processing begins.
2. IP anonymization is applied to the client address using the configured method: redact or hash.
3. Redact replaces the IP with a placeholder. Hash converts it to a consistent one-way identifier that allows session-level analytics without storing the real address.
4. The anonymized value is used in all downstream exports: OTEL traces, OTEL metrics, and request logs.
5. No raw IP address leaves the router process through any telemetry channel.
6. The default method is redact. One line of YAML switches to hash mode.

## Before & After

| Before Cosmo                                           | With Cosmo                                               |
| ----------------------------------------------------- | ------------------------------------------------------- |
| Manual IP redaction in each service and exporter      | Automatic anonymization at the router, applied before any export  |
| Risk of raw IPs appearing in traces or logs after a config change | Privacy enforced at a single control point with no bypass path |
| Complex configuration for GDPR data minimization      | Enabled by default with a single one-line override to switch modes |
| Inconsistent anonymization across distributed services | Uniform protection across OTEL traces, metrics, and access logs |

## Configuration

### Redact or hash

```yaml
compliance:
  anonymize_ip:
    enabled: true
    method: redact # or "hash"
```

Default is `redact`. Switch to `hash` when you need anonymous user session tracking across requests.

## How IP anonymization works in Cosmo Router

01
### Intercept
The router reads the client IP from the incoming request before any telemetry attribute is written.

02
### Anonymize
Redact removes the address entirely, replacing it with a placeholder. Hash applies a one-way function, producing a stable anonymous identifier.

03
### Propagate
The anonymized value is attached to OTEL trace spans, metric attributes, and request log lines. The raw address is never written.

04
### Audit
Default-on behavior means your telemetry config demonstrates data minimization to auditors without requiring additional controls.

## Privacy controls

### Built-in, no configuration required

Default-on protection with a single toggle to change modes.

### On by default

IP anonymization is enabled in every Cosmo Router deployment. No configuration required for the base protection.

### Redact mode

Completely removes the IP address from all telemetry output. Maximum privacy, minimum data.

### Hash mode

Converts IP addresses to a consistent one-way hash. Allows anonymous user session analytics while protecting the real address.

### Zero latency overhead

Anonymization runs synchronously in the router process, before any I/O. No measurable effect on request latency.

## Deploy with IP anonymization on

Start the Cosmo Router with default settings. IP anonymization is already active.

## FAQ

### IP anonymization on Cosmo Router

- Is IP anonymization enabled by default?
- What is the difference between redact and hash?
- How do I switch from redact to hash?
- Which telemetry channels does this cover?
- Does this satisfy GDPR data minimization requirements?
- Can I disable IP anonymization?