Privacy and Permissions¶

Privacy rules must take effect before data enters the RUM or Log queue. Both C# and Native C/C++ support redaction of URL query strings, HTTP request headers, and response headers, and can handle business-sensitive fields through the generic Modifier.

Permission Configuration¶

The Windows SDK does not actively request system permissions. The application must ensure that the process can access the configured reporting endpoint and cache directory; WebView2, window handles, and network components still follow the permissions and security policies of the host application.

Default Behavior¶

Data	.NET / C#	Native C/C++
URL Query	Retains non-sensitive values, default sensitive parameters replaced with `<redacted>`	Same
HTTP Header	Collects and redacts authentication-related headers by default	Same
User and Custom Attributes	Can be redacted via `DataModifier` or `LineDataModifier`	Same
Log Content and Attributes	Can be redacted via `DataModifier` or `LineDataModifier`	Same
Trace Header	Only sent to targets allowed by `ShouldTrace`/`should_trace`	Same

Default sensitive query parameter names include token, access_token, refresh_token, client_secret, password, passwd, secret, api_key, apikey, auth, and authorization. Default sensitive header names include Authorization, Cookie, Set-Cookie, Proxy-Authorization, X-Api-Key, X-Auth-Token, and X-Datakit-Token.

Unified Processing Order¶

Data from RUM, Log, WebView, and Native Browser Bridge use the same processing order before being written to the disk cache:

DataModifier: Processes existing tags and fields one by one; retains the original value when returning null or when the Native callback returns 0.
LineDataModifier: Inspects the entire data line by Measurement and updates existing fields; newly added fields are ignored.
HTTP privacy rules: Finally processes URL query strings, request headers, and response headers to prevent custom Modifiers from bypassing configured network redaction rules.
Formats and writes to cache.

Modifiers may execute concurrently across multiple collection threads; do not perform time-consuming operations in callbacks. Exceptions in callbacks will not interrupt data collection, and the corresponding fields retain their original values.

Privacy Configuration¶

.NET / C#Native C/C++

GuanceSdk.Init(new GuanceConfig
{
    DatawayUrl = "https://openway.guance.com",
    ClientToken = "<client-token>",
    RumAppId = "<rum-app-id>",
    DataModifier = (key, value) =>
    {
        return key switch
        {
            "user_email" => "<redacted>",
            "phone" => "<redacted>",
            _ => null
        };
    },
    LineDataModifier = (measurement, data) =>
    {
        if (measurement == "error" && data.ContainsKey("error_message"))
        {
            return new Dictionary<string, object?>
            {
                ["error_message"] = "<redacted-error>"
            };
        }
        return null;
    },
    Privacy = new RumPrivacyConfig
    {
        CaptureHttpHeaders = true,
        CaptureUrlQueryString = true,
        RedactAllUrlQueryValues = false,
        RedactedValue = "<redacted>",
        RedactedHeaderNames = new[]
        {
            "Authorization",
            "Cookie",
            "Set-Cookie",
            "X-Api-Key"
        },
        RedactedQueryParameterNames = new[]
        {
            "token",
            "password",
            "secret"
        }
    }
});

Parameter	Default	Description
`CaptureHttpHeaders`	`true`	Whether to record redacted request and response headers.
`CaptureUrlQueryString`	`true`	Whether to retain the URL query string. If disabled, the entire query string is removed.
`RedactAllUrlQueryValues`	`false`	Whether to redact all query values.
`RedactedValue`	`<redacted>`	Redaction replacement text.
`RedactedHeaderNames`	Authentication-related headers	Header name list, case-insensitive.
`RedactedQueryParameterNames`	Sensitive parameter names list	Query parameter name list, case-insensitive.

Both DataModifier and LineDataModifier are optional configurations. If only default HTTP redaction is needed, configure only Privacy.

#include <cstring>

static int modify_data(
    const char* key,
    const guance_data_value*,
    guance_data_value* replacement,
    void*) {
    if (std::strcmp(key, "user_email") != 0) {
        return 0;
    }
    replacement->type = GUANCE_DATA_VALUE_STRING;
    replacement->value.string_value = "<redacted>";
    return 1;
}

static void modify_line(
    const char* measurement,
    guance_data_item* data,
    uint32_t data_count,
    void*) {
    if (std::strcmp(measurement, "error") != 0) {
        return;
    }
    for (uint32_t index = 0; index < data_count; ++index) {
        if (std::strcmp(data[index].key, "error_message") == 0) {
            data[index].value.type = GUANCE_DATA_VALUE_STRING;
            data[index].value.value.string_value = "<redacted-error>";
        }
    }
}

guance_sdk_config sdk_config;
guance_sdk_config_init(&sdk_config);
sdk_config.dataway_url = "https://openway.guance.com";
sdk_config.client_token = "<client-token>";
sdk_config.rum_app_id = "<rum-app-id>";
guance_sdk_handle rum = guance_sdk_init(&sdk_config);

guance_data_modifier_config modifiers;
guance_data_modifier_config_init(&modifiers);
modifiers.data_modifier = modify_data;
modifiers.line_data_modifier = modify_line;
guance_configure_data_modifiers(rum, &modifiers);

const char* redacted_query_names[] = {
    "token",
    "password",
    "secret"
};
const char* redacted_header_names[] = {
    "Authorization",
    "Cookie",
    "Set-Cookie",
    "X-Api-Key"
};

guance_rum_resource_collection_config privacy;
guance_rum_resource_collection_config_init(&privacy);
privacy.capture_http_headers = 1;
privacy.capture_url_query = 1;
privacy.redact_all_url_query_values = 0;
privacy.redacted_value = "<redacted>";
privacy.redacted_query_parameter_names = redacted_query_names;
privacy.redacted_query_parameter_name_count = 3;
privacy.redacted_header_names = redacted_header_names;
privacy.redacted_header_name_count = 4;

guance_rum_configure_resource_collection(rum, &privacy);

All Native configuration structures must call the corresponding *_init() first. The HTTP privacy configuration copies the header and query parameter name lists; Modifiers retain the function pointer and user_data, and they must remain valid until reconfiguration or guance_sdk_shutdown(). Modifiers may execute concurrently and must not be re-invoked on the same SDK handle.

Data Redaction¶

Disable Network Data Collection¶

.NET / C#Native C/C++

GuanceSdk.EnableAutomaticInstrumentation(new AutomaticInstrumentationOptions
{
    EnableHttpClient = false,
    EnableWebView = false
});

To disable only headers or query strings:

Privacy = new RumPrivacyConfig
{
    CaptureHttpHeaders = false,
    CaptureUrlQueryString = false
}

guance_rum_resource_collection_config resource_config;
guance_rum_resource_collection_config_init(&resource_config);
resource_config.enabled = 0;
guance_rum_configure_resource_collection(rum, &resource_config);

Target Filtering¶

Native Resources can filter collection targets via should_collect; C# should perform equivalent filtering in business handlers or manual Resource boundaries. Trace Headers must be restricted to trusted services through the target allowlist in Trace Configuration.

User, Log, and Custom Fields¶

Do not write passwords, tokens, identity documents, payment information, or full authentication headers.
User IDs should use stable identifiers or hashes allowed by the business.
Log content and attributes are not automatically aware of business-sensitive fields; redaction should be performed via Modifiers or before calling AddLog().
Custom attributes must not overwrite SDK reserved fields; conflicting fields are ignored.

Session Replay Privacy¶

Experimental feature

Session Replay is disabled by default and can be explicitly enabled for verification, but it remains an experimental feature. Before enabling, you must confirm that the default policy and element-level overrides meet the business privacy requirements.

The global privacy level, element-level overrides, and WebView2/Electron privacy boundaries for Session Replay are consolidated in Windows Session Replay Privacy Configuration and Privacy Override.