Is IP anonymization enabled by default?

Yes. The default configuration enables IP anonymization with redact mode. No YAML changes are required for basic privacy protection.

What is the difference between redact and hash?

Redact replaces the IP address with a placeholder, removing it from all telemetry. Hash applies a one-way cryptographic function, producing a consistent anonymous identifier that allows session-level analysis without storing the actual address.

How do I switch from redact to hash?

Set `method: hash` in the `compliance.anonymize_ip` block of your router configuration YAML. Restart the router for the change to take effect.

Which telemetry channels does this cover?

IP anonymization applies to OpenTelemetry trace span attributes, OpenTelemetry metric attributes, and access log fields. All three channels use the same anonymized value.

Does this satisfy GDPR data minimization requirements?

IP anonymization in redact mode removes personal data from telemetry at the infrastructure level, which supports GDPR data minimization obligations. Consult your legal team for a determination specific to your deployment.

Can I disable IP anonymization?

Yes. Set `enabled: false` in the `compliance.anonymize_ip` block. This is not recommended for production deployments where GDPR or similar regulations apply.

IP Anonymization for GraphQL Telemetry | Cosmo by WunderGraph

The problem

Every telemetry sink is a potential PII leak

IP addresses land in traces, metrics, and logs by default. Most infrastructure is not configured to strip them. Auditors ask where every raw IP ended up.

IP addresses are PII by default

Under GDPR and similar regulations, IP addresses count as personal data. Capturing them in traces, metrics, and logs creates compliance exposure you have to document and justify.

Manual anonymization gets missed

Retrofitting IP redaction across every service, exporter, and log pipeline is error-prone. One unconfigured sink is all it takes to fail an audit.

Inconsistent coverage across services

When each team handles anonymization independently, the guarantees are uneven. The data platform may redact; the router may not. Auditors notice.

Our solution

Privacy enforced at a single control point

Cosmo Router intercepts IP addresses before any telemetry export. One configuration block controls the behavior across traces, metrics, and logs. There is no bypass path.

How anonymization works

The Cosmo Router intercepts every incoming request before any telemetry processing begins.
IP anonymization is applied to the client address using the configured method: redact or hash.
Redact replaces the IP with a placeholder. Hash converts it to a consistent one-way identifier that allows session-level analytics without storing the real address.
The anonymized value is used in all downstream exports: OTEL traces, OTEL metrics, and request logs.
No raw IP address leaves the router process through any telemetry channel.
The default method is redact. One line of YAML switches to hash mode.

One config block. Full coverage across every telemetry channel.

IP anonymization

Before & After

Before Cosmo	With Cosmo
Manual IP redaction in each service and exporter	Automatic anonymization at the router, applied before any export
Risk of raw IPs appearing in traces or logs after a config change	Privacy enforced at a single control point with no bypass path
Complex configuration for GDPR data minimization	Enabled by default with a single one-line override to switch modes
Inconsistent anonymization across distributed services	Uniform protection across OTEL traces, metrics, and access logs

Configuration

Redact or hash

compliance:
  anonymize_ip:
    enabled: true
    method: redact # or "hash"

Default is redact. Switch to hash when you need anonymous user session tracking across requests.

How IP anonymization works in Cosmo Router

01

Before any export.

Intercept

The router reads the client IP from the incoming request before any telemetry attribute is written.

02

Redact or hash. Your choice.

Anonymize

Redact removes the address entirely, replacing it with a placeholder. Hash applies a one-way function, producing a stable anonymous identifier.

03

Traces, metrics, logs. All covered.

Propagate

The anonymized value is attached to OTEL trace spans, metric attributes, and request log lines. The raw address is never written.

04

Privacy by default. Auditable.

Audit

Default-on behavior means your telemetry config demonstrates data minimization to auditors without requiring additional controls.

Privacy controls

Built-in, no configuration required

Default-on protection with a single toggle to change modes.

On by default

IP anonymization is enabled in every Cosmo Router deployment. No configuration required for the base protection.

Redact mode

Completely removes the IP address from all telemetry output. Maximum privacy, minimum data.

Hash mode

Converts IP addresses to a consistent one-way hash. Allows anonymous user session analytics while protecting the real address.

Zero latency overhead

Anonymization runs synchronously in the router process, before any I/O. No measurable effect on request latency.

Deploy with IP anonymization on

Start the Cosmo Router with default settings. IP anonymization is already active.

Start Free Read the Docs

IP addresses redacted from telemetry by default