To reduce sensitive data in LangGraph traces, decide what LangSmith may collect before enabling production tracing. Hide inputs and outputs for broad minimization, transform them before export when you need some debugging detail, and disable tracing for requests that must not produce a trace. These controls govern trace data—not necessarily what the model receives, what your application logs, or what graph checkpoints persist.
Know which data path you are protecting
LangSmith records work as runs—such as model calls, tool invocations, or retrieval operations—and groups runs into traces for an operation. A trace can contain inputs and outputs across nested runs, not just the initial user message. Review tool arguments, retrieved content, model responses, errors, and custom state representations as well as the top-level prompt. LangChain describes trace inputs and outputs in its guide to preventing sensitive data from being logged.
Keep these paths distinct when setting policy:
- Trace export: what the LangSmith tracing client sends to its backend.
- Model input: what your application sends to the model provider.
- Graph state and checkpoints: data persisted for graph execution.
- Other logs and services: application logs, error reporting, and any other systems that receive the request or its results.
Masking trace data does not, by itself, redact the prompt before the model sees it. Likewise, turning off LangSmith tracing alone does not prove that other systems stopped retaining the data.
Choose a LangSmith control for each trace field
Inputs, outputs, and metadata need deliberate handling. LangSmith documents environment variables LANGSMITH_HIDE_INPUTS=true and LANGSMITH_HIDE_OUTPUTS=true, as well as per-client callbacks: hide_inputs and hide_outputs in Python, and hideInputs and hideOutputs in TypeScript. A callback can remove a full payload or return a transformed subset. Metadata has separate controls: use hide_metadata=True to remove it, or a callable to filter or transform it.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
For selected-field masking, the SDK anonymizer supports regex patterns with replacement values or a custom function. The guide demonstrates substitutions for email addresses and UUIDs, and documents integrations with Microsoft Presidio and Amazon Comprehend. Rule-based masking is documented for LangSmith SDK Python 0.1.81 and later and TypeScript 0.1.33 and later. Function-level @traceable processors, process_inputs and process_outputs, are available in Python SDK 0.1.98 and later; when both a function-level processor and a client-level input/output processor are defined, the function-level processor takes precedence.
These version floors and behaviors are documented by LangChain; check the guide and the SDK version in your deployment before relying on a particular option.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Compare the controls before choosing one
| Control | What it does | Debugging value | Important trade-off |
|---|---|---|---|
| Hide inputs or outputs | Removes the selected payload from trace logging using environment variables or client callbacks. | Low for the hidden field; other permitted trace fields may remain useful. | Does not redact model input or other persistence paths. |
| Filter or transform callbacks | Returns only approved fields or a transformed representation of inputs, outputs, or metadata. | Can preserve safe diagnostic context. | Coverage depends on the transformation and on applying it to every relevant path. |
| SDK anonymizer or custom function | Replaces matched content, for example with regex rules or a custom transformation. | Can retain structure while masking known patterns. | Patterns can miss formats and edge cases; serialization and complex matching can add overhead. |
| Presidio or Comprehend integration | Uses a third-party PII detection service rather than only fixed local matching rules. | May help detect categories beyond hand-written patterns. | Consider service data flow, operational cost, latency, and limits; it is not automatically safer or complete. |
| Conditional tracing | Skips trace creation for selected requests. | No trace is available for a skipped request. | Use when the request must not be collected in LangSmith; audit other stores independently. |
Use conditional tracing when masking is not enough
If policy says a request must not be traced, use LangSmith conditional tracing to avoid sending a trace for that request. Masking changes what is logged; it is not equivalent to suppressing collection. Enforce the condition where the request is handled, and verify that the protected branch cannot fall through to a traced client or decorator.
Trace suppression is not a system-wide retention guarantee. Separately review application logs, model-provider handling, graph checkpoints, and any other persistence or observability service in the request path.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Account for Agent Server destinations and persisted state
For LangGraph Agent Server, the documented trace destination depends on deployment mode. Cloud requires tracing to LangSmith SaaS. Hybrid and Self-Hosted deployments offer optional tracing and additional destination choices; Self-Hosted deployments can use Self-Hosted LangSmith. Confirm the destination and retention settings for the deployment you actually operate rather than assuming every mode sends data to the same place.
Agent Server persistence is another path to assess. PostgreSQL stores server resources, including runs, and is the default checkpoint backend for graph execution state. MongoDB can be used instead for checkpoint storage, while PostgreSQL remains required for other server resources. Trace masking should therefore be reviewed separately from checkpoint and data-plane retention.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Test masking as a coverage problem
Do not treat a successful match on one sample email or card number as proof that sensitive content is absent. LangChain warns that its regex example is not exhaustive. The SDK anonymizer serializes payloads to JSON before processing and traverses to a default maximum depth of 10. Test deeply nested objects, non-string values, unusual encodings, localized formats, obfuscated values, secrets in custom state, and error paths.
The documented Amazon Comprehend example makes one PII-detection API call per string, shows a per-call text limit of 100 KB, and leaves oversized text unchanged in that example. It may be rate-limit-bound; these are implementation details of the example, not performance results for your application. Measure latency and throughput in your own environment before adopting external detection or complex matching.
Free tools Windows power users keep installed
One-click scans. No signup required.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
- Inventory the payloads: identify sensitive fields in top-level inputs, nested tool calls, retrieval results, outputs, metadata, errors, custom state, and checkpoints.
- Set an explicit policy by data class: decide which inputs, outputs, and metadata should be hidden, transformed, or retained.
- Cover every trace path: check client callbacks and function-level processors, including components that may create runs independently.
- Test with representative synthetic or approved data: assert that known sensitive markers do not appear anywhere in emitted trace fields, including nested values and failure cases.
- Test the unprotected failure mode: verify what happens if a client callback or decorator is omitted, and confirm that high-risk requests are conditionally excluded at handling time.
- Check separate storage and model paths: validate logging, checkpoint, and provider behavior independently of the trace policy.
- Measure in your environment: compare latency and throughput with the chosen transformation or detection approach enabled.
Redact before the model only when that is the goal
Trace masking controls what the tracing client exports. If the goal is to prevent the model from receiving selected sensitive prompt content, an upstream control must act before the model call. Arcjet Redact documents a LangChain JavaScript integration that wraps an LLM, redacts selected entities from prompt text before sending it to that LLM, then unredacts the response before returning it. Its documentation lists email, phone number, IP address, and credit card as example entity types and describes custom detection and replacement hooks.
That integration addresses model-input exposure, not LangSmith trace export. Evaluate whether the package, language, and behavior fit your application and threat model, and retain separate trace controls where trace collection itself needs to be limited.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
