What is logged and encrypted

Per event

Data	Stored
Prompt and answer	The text as checked and logged: masked when masking is on (browser extension prompts are stored redacted in any case). With Store Encrypted Payloads on, the views show a redacted value and the content is stored encrypted
Originals behind placeholders	Only with Store Encrypted Payloads on, encrypted, and only visible through an audited Reveal
What the provider received per masked value	For browser extension turns, the token and the value sent (the token itself)
Detection results	Detected entity types, security signals, the guardrail decision and its reason
Identity	`user_id`, the API key's name, prefix, owner label and environment, and request identity hints you send
Model and usage	Model id, token counts, latency and cost (from your `usage` data)
Attachments	File names, types, extraction results and the masked text; never the original file after protection

What leaves your side

Recipient	Receives
AI provider	The protected text with placeholders; never the placeholder mapping
AgentID logs	The masked text, plus encrypted originals only if you enable encrypted storage
The user	The answer with originals restored on their device, if restoration is on

Guard itself must read the original text to detect sensitive values. It processes the text in memory for the check; what it keeps afterwards is listed above.

Encrypted storage

When Store Encrypted Payloads is enabled in Guardrails:

prompts, outputs and the token-to-original mapping are encrypted before they are stored, with AES-256-GCM and a separate data key per event,
list and detail views show redacted placeholders instead of content,
if encryption is required but not available, AgentID refuses to store the event instead of storing plaintext.

Admins of an AI system can Reveal payload on an encrypted event in the activity log. Each Reveal is written to the audit log as ENCRYPTED_EVENT_PAYLOAD_VIEWED, recording whether the input, the output and the masking originals were revealed. Events erased under a GDPR request cannot be revealed.

Local data on user devices

Integration	Stored locally
Browser extension	Placeholder mappings per conversation, encrypted with a non-extractable key in the extension's own storage, for 30 days after last use; provider pages cannot read them
Claude plugin	An encrypted per-session vault (AES-256-GCM) for 7 days; the device credential in the OS credential store (DPAPI on Windows, Keychain on macOS) or an owner-only file
Claude Desktop companion	The device credential (DPAPI on Windows, Keychain on macOS)

Webhooks

Security events sent to your webhooks carry SHA-256 hashes of the input and output instead of the text, plus the event metadata. For systems that block personal information, the payload is redacted before delivery.