Data privacy

Apitally is built with a strong focus on data privacy. We hold ourselves to these principles:

Collect only the data that’s required
Offer extensive configuration options to control data collection, masking and filtering
Provide full transparency about what data is collected and how it’s handled

Because all Apitally SDKs are open-source, you can verify yourself how they work and what data they collect.

Data collection

This is a complete overview of the data collected by Apitally.

The configuration options mentioned throughout this page are in snake_case notation, as used in Python. Check out the SDK reference for your language to see the equivalent parameter names.

Icons indicate configurable data collection and masking support: = Configurable, collected by default
= Configurable, not collected by default
= Supports masking

Application metadata

The Apitally SDKs record details of your application’s API, configuration and runtime environment.

Endpoints

HTTP methods and route paths identified by the SDK, with summaries and descriptions where the framework provides them.Example:

[
  {"method": "GET", "path": "/v1/orders"},
  {"method": "GET", "path": "/v1/orders/{orderId}"},
  {"method": "POST", "path": "/v1/orders"}
]

Framework and versions

Framework identifier, runtime and framework package versions, and an application version if you provide one.Example versions:

{
  "fastapi": "0.121.1",
  "starlette": "0.49.3",
  "python": "3.13.9"
}

SDK configuration

SDK settings, including capture and sampling settings and custom masking and exclusion patterns. Configured callbacks are recorded as true, not their code. The write token is excluded.

OpenAPI specification

The complete generated OpenAPI specification, when available from FastAPI, Litestar, Django REST Framework or Django Ninja.

Resource attributes

Service name, a random instance identifier, environment, and the names and versions of the Apitally and OpenTelemetry SDKs.Custom OpenTelemetry resource attributes supplied through environment variables or an existing provider are also included.

Application metrics

CPU utilization, memory usage and uptime are measured periodically for each application process.

CPU utilization

CPU utilization of the application process.

Memory usage

Resident memory usage of the application process.

Uptime

Uptime in seconds.

Request metrics

Request measurements are combined into counts and histograms within your application before being sent to Apitally.

HTTP method and path

Method and path of the endpoint that handled the request.Example: POST /v1/orders

Response status code

Status code of the response.Example: 200 OK

Request size

Size of the request body. Recorded as a histogram.Example: 5 KB

Response size

Size of the response body. Recorded as a histogram.Example: 5 KB

Response time

Time taken by your application to respond to the request. Recorded as a histogram.Example: 80 ms

Consumer

Consumer identifier, and optionally name, group and custom attributes, as provided by your own implementation.See the setup guide for your framework for how to associate requests with consumers.Example:

{
  "identifier": "john.doe@example.com",
  "name": "John Doe",
  "group": "Users",
  "attributes": {"plan": "pro"}
}

Validation error info

Details about validation errors leading to a 4xx response. Includes source, field name, message and error type.Only captured if a supported framework is used. See here for details.Example:

[
  {"source": "query", "field": "title", "message": "ensure this value has at least 3 characters", "type": "value_error.any_str.min_length"}
]

Exception info

Exception type, message and stack trace. May also include a Sentry event ID, if available.Only captured if an exception occurred during request handling, leading to a 500 Internal Server Error response.Example:

File 'app/api/endpoints.py', line 89, in get_item
  item = items_list[position]
IndexError: 'List index out of range'

Request logs

Request logs contain details of individual requests, along with associated application logs and traces.

HTTP method and path

Method and path of the endpoint that handled the request.Example: POST /v1/orders

URL

The full request URL, including query parameters.Default masking rules apply to query parameter values. Additional masking rules can be specified using mask_query_params.Example: https://api.example.com/v1/books?search=api+design

Client IP

IP address of the client, as reported by your framework.Example: 192.0.2.1

User agent

User agent string identifying the client software.Example: curl/8.10.1

Response status code

Example: 200 OK

Request size

Size of the request body in bytes.Example: 4786 bytes

Request headers

Only collected if enabled via capture_request_headers (disabled by default). Default masking rules apply. Additional masking rules can be specified using mask_headers.Example:

Host: api.example.com
Authorization: [REDACTED]
X-Real-Ip: 147.98.24.101

Request body

Only collected if enabled via capture_request_body (disabled by default). Default masking rules apply. Additional masking rules can be specified using mask_body_fields and mask_request_body.Example:

{"message":"Hello world"}

Response size

Size of the response body in bytes.Example: 4678 bytes

Response headers

Can be disabled via capture_response_headers (enabled by default). Default masking rules apply. Additional masking rules can be specified using mask_headers.Example:

Content-Type: application/json
Content-Length: 36

Response body

Only collected if enabled via capture_response_body (disabled by default). Default masking rules apply. Additional masking rules can be specified using mask_body_fields and mask_response_body.Example:

{"message":"Hello world"}

Response time

Time taken by your application to respond to the request.Example: 82 ms

Consumer

{
  "identifier": "john.doe@example.com",
  "name": "John Doe",
  "group": "Users",
  "attributes": {"plan": "pro"}
}

Application logs

Application log records associated with the request, including messages, timestamps, severity, logger information and available attributes.Can be disabled via capture_logs (enabled by default).Example:

[
  {"timestamp": "2025-12-01T12:34:56.000Z", "message": "Example 1", "level": "info"},
  {"timestamp": "2025-12-01T12:34:56.001Z", "message": "Example 2", "level": "warning"}
]

Traces

The request span and associated OpenTelemetry spans, including their attributes. These can contain custom request attributes, outgoing request URLs and database queries supplied by instrumentation.Example:

[
  {
    "span_id": "a1b2c3d4e5f60001",
    "name": "GET /v1/orders/{orderId}",
    "kind": "SERVER",
    "start_time": 1735689600000000000,
    "end_time": 1735689600082000000
  },
  {
    "span_id": "a1b2c3d4e5f60002",
    "parent_span_id": "a1b2c3d4e5f60001",
    "name": "SELECT orders",
    "kind": "CLIENT",
    "start_time": 1735689600001000000,
    "end_time": 1735689600045000000,
    "attributes": {"db.system": "postgresql"}
  }
]

Exception info

Exception type, message and stack trace recorded in the request’s trace. May also include a Sentry event ID, if available.Example:

File 'app/api/endpoints.py', line 89, in get_item
  item = items_list[position]
IndexError: 'List index out of range'

Data masking

The Apitally SDKs mask common sensitive query parameters, headers and request/response body fields on the client side using the default patterns (regular expressions) below. These default patterns are case-insensitive and match anywhere within the name. You can add additional patterns using the configuration options in each section.

Query parameters

auth
api[-_]?key
secret
token
password
pwd

You can add additional patterns via the mask_query_params option.

Headers

auth
api[-_]?key
secret
token
cookie

You can add additional patterns via the mask_headers option.

Body fields

The following patterns apply to string-valued fields in JSON request and response bodies.

password
pwd
token
secret
auth
card[-_ ]?number
ccv
cvv
cvc
ssn

You can add additional patterns via the mask_body_fields option. For more granular control you can also specify callback functions via mask_request_body and mask_response_body.

Application logs

You can mask application log messages using the mask_log_record callback. See the SDK reference for Python, JavaScript, Go or .NET.

Data filtering

You can exclude selected requests from request logs, along with their associated traces and application logs. Exclusions can be based on the request path or custom conditions using sampling callbacks. The SDK applies these exclusions within your application before sending data to Apitally. Request metrics are still collected for excluded requests. See the SDK reference for Python, JavaScript, Go or .NET.

Data transit

Apitally uses HTTPS and TLS to send data from your application, running the Apitally SDK, to our servers.

Data storage

Apitally stores data in a ClickHouse database hosted on DigitalOcean in the US. The underlying block storage volume is encrypted at rest. Database backups are created hourly and are stored in a private Spaces bucket. Data in Spaces is also encrypted at rest.

Data retention

Apitally retains aggregated request metrics for 13 months, allowing you to analyze long-term trends. CPU utilization, memory usage and uptime monitoring data are retained for 32 days. Request logs, application logs and traces are retained for 15 days by default, with longer retention available on request. When an app is deleted in the Apitally dashboard, all associated data is deleted from the database, but is still included in previously created backups. Database backups are kept for 7 days.

Compliance

Apitally currently doesn’t hold certifications like SOC 2 or ISO 27001, and is not HIPAA compliant yet. Please reach out if you need help documenting Apitally as a vendor for your own compliance requirements.

Overview

API metrics

API logs & traces

API monitoring

For agents

Data collection

Application metadata

Application metrics

Request metrics

Request logs

Data masking

Query parameters

Headers

Body fields

Application logs

Data filtering

Data transit

Data storage

Data retention

Compliance

​Data collection

​Application metadata

​Application metrics

​Request metrics

​Request logs

​Data masking

​Query parameters

​Headers

​Body fields

​Application logs

​Data filtering

​Data transit

​Data storage

​Data retention

​Compliance

Data collection

Application metadata

Application metrics

Request metrics

Request logs

Data masking

Query parameters

Headers

Body fields

Application logs

Data filtering

Data transit

Data storage

Data retention

Compliance