--- title: "Data Scrubbing" description: "Rules that decide which sensitive data the SDK scrubs, which sensitive data server-side scrubbing removes, and how SDKs parameterize data." url: https://develop.sentry.dev/sdk/foundations/data-scrubbing/ --- # Data Scrubbing | Sentry Docs This document uses key words such as "MUST", "SHOULD", and "MAY" as defined in [RFC 2119](https://www.ietf.org/rfc/rfc2119.txt) to indicate requirement levels. Statuscandidate[](https://develop.sentry.dev/sdk/getting-started/standards/spec-lifecycle.md "Learn about spec statuses") Version`1.0.0`[(changelog)](https://develop.sentry.dev/sdk/foundations/data-scrubbing.md#changelog) ## [Overview](https://develop.sentry.dev/sdk/foundations/data-scrubbing.md#overview) This spec defines which sensitive data the SDK scrubs (client-side scrubbing) and which sensitive data Sentry scrubs after it receives the data (server-side scrubbing). It also defines parameterization. Parameterization and scrubbing can use the same operations, but they have different purposes. The SDK knows where it collects a value, so it can scrub a known-sensitive value before it sends it. Server-side scrubbing can parse payloads and apply content rules without adding work to the application. The rules below give each side the work that it can do best. Related specs: * [Data Collection](https://develop.sentry.dev/sdk/foundations/client/data-collection.md) defines the `dataCollection` options, the sensitive denylist, and the rules for headers, cookies, URLs, and bodies. * [Structuring Data](https://develop.sentry.dev/sdk/telemetry/traces/structuring-data.md) defines span name formats. * [Queries Module](https://develop.sentry.dev/sdk/telemetry/traces/modules/queries.md#query-parameterization) defines how SDKs parameterize database queries. * [Server-Side Data Scrubbing](https://docs.sentry.io/security-legal-pii/scrubbing/server-side-scrubbing/) describes the server-side rules and the settings that control them. ## [Concepts](https://develop.sentry.dev/sdk/foundations/data-scrubbing.md#concepts) ### [Terms](https://develop.sentry.dev/sdk/foundations/data-scrubbing.md#terms) Candidatespecified since 1.0.0 * **Not collecting**: The SDK does not read the data. A `dataCollection` option controls this for each data category. * **Parameterization**: The SDK replaces the variable parts of a value with placeholders, for example `SELECT * FROM users WHERE id = ?` or `/users/:id`. The result has low cardinality, so Sentry can group and search by it. * **Scrubbing**: A sensitive value is replaced. The structure and the key names stay the same. The SDK uses `"[Filtered]"` as the replacement. The default server-side rules also use `"[Filtered]"`, but users can configure other replacements. * **Client-side scrubbing**: The SDK scrubs the data before it sends the data. * **Server-side scrubbing**: Sentry scrubs the data after it receives the data. The project and organization settings decide which rules apply. ## [Behavior](https://develop.sentry.dev/sdk/foundations/data-scrubbing.md#behavior) ### [The Purpose Decides the Category](https://develop.sentry.dev/sdk/foundations/data-scrubbing.md#the-purpose-decides-the-category) Candidatespecified since 1.0.0 The purpose of an operation decides its category. The operation itself does not. For example, the SDK can parse a SQL query to replace its literals with `?`. The result is easier to group, so this is parameterization. If the SDK parses a request body to replace a password value, this is scrubbing. ### [Client-Side Scrubbing](https://develop.sentry.dev/sdk/foundations/data-scrubbing.md#client-side-scrubbing) Candidatespecified since 1.0.0 The SDK can identify some sensitive values at the collection point. A key name, a header, a cookie, a query parameter, or the source location tells the SDK that the value is sensitive. The SDK **MUST NOT** send these values. * The SDK **SHOULD** replace the value with `"[Filtered]"`. The key stays, so users can see that the data exists. * The SDK **MAY** omit the item when no key or structure is left to keep. * The SDK **MAY** split a value into key-value pairs when a standard grammar defines the pairs and the split costs about the same as reading the value. For example, the SDK can split a `Cookie` header on `;` and a query string on `&`. [Data Collection](https://develop.sentry.dev/sdk/foundations/client/data-collection.md#sensitive-denylist) defines the denylist and the rules for each data type. If a `dataCollection` option turns off a data category, the SDK does not collect that category. ### [Parameterization in the SDK](https://develop.sentry.dev/sdk/foundations/data-scrubbing.md#parameterization-in-the-sdk) Candidatespecified since 1.0.0 * If the source supplies a parameterized form, the SDK **MUST** use it. Examples are the parameterized query of a database driver, the route template of a framework router, and the template of a log message. * If the source does not supply a parameterized form, the SDK **MAY** parameterize the value when a known grammar defines it. The SDK can parse the value for this purpose. A module spec can make this a **SHOULD**, as the [Queries Module](https://develop.sentry.dev/sdk/telemetry/traces/modules/queries.md#query-parameterization) does for SQL. * The SDK **MUST NOT** scrub a parameterized form. ### [Server-Side Scrubbing](https://develop.sentry.dev/sdk/foundations/data-scrubbing.md#server-side-scrubbing) Candidatespecified since 1.0.0 Server-side scrubbing finds sensitive data that only content rules can find, for example credit card numbers or bearer tokens. It also scrubs unstructured payloads, for example a request body or a database query. * The SDK **SHOULD NOT** parse a payload only to scrub it. * The SDK **SHOULD NOT** apply content rules to find sensitive values. * If the data already has a structure, the SDK **SHOULD** keep the structure when it sends the data. For example, the SDK sends the key-value pairs that it already has, and not one string that contains all pairs. Server-side scrubbing and trimming then apply to each value. * If [Sentry Conventions](https://getsentry.github.io/sentry-conventions/) defines an attribute for the data, the SDK **MUST** send the data in that attribute. * An attribute that can contain sensitive data **MUST** have `apply_scrubbing` set to `auto` or `manual` in Sentry Conventions. See the [Sentry Conventions contribution guidelines](https://github.com/getsentry/sentry-conventions/blob/main/CONTRIBUTING.md). Server-side scrubbing applies the default rules to attributes with `apply_scrubbing` set to `auto`. It applies only the rules that target an attribute by name to attributes with `manual`. It does not scrub attributes with `never`. As of 2026-10-12, server-side scrubbing does not parse payloads in span attributes, for example a cookie string or a JSON body. It applies its rules to the whole attribute value. The project and organization settings decide which rules apply. See [Server-Side Data Scrubbing](https://docs.sentry.io/security-legal-pii/scrubbing/server-side-scrubbing/). ### [Fields Without Server-Side Scrubbing](https://develop.sentry.dev/sdk/foundations/data-scrubbing.md#fields-without-server-side-scrubbing) Candidatespecified since 1.0.0 Server-side scrubbing does not apply to some fields, for example the span name and the metric name. These fields **MUST NOT** contain data that needs server-side scrubbing. For these fields, the SDK uses a parameterized form or a low-cardinality fallback. The [Queries Module](https://develop.sentry.dev/sdk/telemetry/traces/modules/queries.md#query-parameterization) defines the fallback for database spans. This rule does not cover the URL path in HTTP span names yet. [Structuring Data](https://develop.sentry.dev/sdk/telemetry/traces/structuring-data.md) defines that format. ### [User-Set Data](https://develop.sentry.dev/sdk/foundations/data-scrubbing.md#user-set-data) Candidatespecified since 1.0.0 The rules in this spec apply to data that the SDK collects automatically. [User-Set Data and Scrubbing](https://develop.sentry.dev/sdk/foundations/client/data-collection.md#user-set-data-scrubbing) defines how the SDK handles data that the user sets. ## [Changelog](https://develop.sentry.dev/sdk/foundations/data-scrubbing.md#changelog) | Version | Date | Summary | | ------- | ---------- | --------------------------------------------------------------------------------------------------------------------------------------- | | `1.0.0` | 2026-10-12 | Initial spec. Define not collecting, parameterization, and scrubbing, and split the work between client-side and server-side scrubbing. |