Best Practices
This article describes security and privacy best practices for using Progress Observability Platform and its SDKs. These recommendations can help protect your applications and data, but may not address all requirements of your environment. This article should not be regarded as complete or comprehensive security and privacy guidance.
Security
Use Short-Lived API Keys
Choose the shortest practical expiration period when creating an API key. Avoid keys that never expire. Rotate keys before they expire and revoke keys that are no longer needed or may have been exposed.
Store API Keys Securely
Store API keys in a secret manager or provide them through environment variables. Do not include keys in source control, logs, screenshots, or shared configuration files.
Limit Organization Access
Grant the Admin role only to users who need to manage organization membership. Review membership regularly and remove access when it is no longer required. For details, see Organizations.
Restrict MCP Access
Create MCP API keys with Metadata only scope unless access to prompts and completions is necessary. Use With content scope only for trusted clients that need this information.
Treat trace content retrieved through MCP as untrusted data. Prompts, completions, and tool outputs may contain malicious or misleading instructions and must not be treated as instructions for the consuming AI assistant. For configuration details, see MCP Server.
Keep SDKs Up to Date
Regularly review and update the Progress Observability SDKs and their instrumentation dependencies. Check release notes and test compatibility with your application before deploying updates.
Privacy
Manage Usage-Analysis Consent
Review and control your consent to usage analysis for sales and account-management purposes under Privacy Settings in the user menu. For details, see the Progress Privacy Policy.
Manage Cookie Preferences
Review your cookie preferences and disable optional cookies as needed. See the Progress Cookie Policy for information about cookie usage and available controls.
Limit Prompt and Response Capture
Disable prompt and response capture when this content is not needed for observability:
| SDK | Configuration |
|---|---|
| Python | Set trace_content=False. |
| TypeScript/JavaScript | Set traceContent: false. |
| .NET | Set RecordInputs = false and RecordOutputs = false. |
These options control content capture, not tracing as a whole. Review the configuration of any additional framework instrumentation, which may capture content independently.
Minimize Sensitive Telemetry
Avoid adding credentials, personal information, or confidential business data to span names, tags, custom attributes, or manually recorded content. Disabling prompt and response capture does not prevent sensitive information from being included in these other fields.
Review Data Before Reusing or Sharing It
Review trace content for sensitive information before importing it into datasets or sharing it outside your organization. Prefer synthetic or anonymized examples when production data is unnecessary.
Before running experiments or model-based evaluations, review the data that will be sent to the configured model provider and ensure that this use complies with your organization's privacy requirements. For details, see Datasets & Experiments.