Skip to Content
PlatformSecurity and privacy

Security and privacy

Morse AI ingests and displays LLM traffic, so its threat model includes the LLM-specific risks a generic APM tool doesn’t have to think about — alongside the redaction and GDPR controls you’d expect from any platform holding customer data.

Prompt-injection and output defenses

Morse’s own Copilot is an LLM agent with access to your trace data, so it’s scanned like one.

  • Prompt-injection scanning — every Copilot input is checked before it reaches a model. Detected attempts are logged (as a hash of the message, never the raw content) rather than silently dropped. The system prompt itself refuses role-change requests, including fake dialogue transcripts crafted to make the model complete a different persona’s pattern rather than asking outright.
  • Output classifier — every Copilot response is checked after generation for system-prompt leaks, hallucinated data (three or more UUIDs that don’t trace back to real records), and redirects to a domain outside an explicit allowlist.
  • Canary tokens — a marker is embedded in the system prompt Copilot is built from; if a response ever echoes it back, the output classifier’s system-prompt-leak check catches it.
  • Second-order injection defense — trace and span content that an eval judge or Copilot tool call reads is never trusted as instructions. It’s wrapped in <untrusted_trace_data> delimiters before it reaches any judge or tool-result-handling LLM call, closing the path where a malicious string recorded inside a trace could hijack a later model call that reads it back.

PII redaction

Redaction runs on both sides:

  • Mandatory server-side redaction — a fixed set of patterns is always applied before spans, metrics, and logs are persisted.
  • Customer-configurable regex — orgs can add their own redaction patterns on top of the mandatory set, resolved per-org with a short-lived cache.

The Python and TypeScript SDKs apply the same pattern set client-side before a span ever leaves your process, and a parity test keeps both implementations in sync with the server.

Your data

  • We do not train on your data. Morse does not use customer telemetry, prompts, or completions to train, fine-tune, or develop machine-learning models. Improvements use aggregated, de-identified usage metrics only. See the Terms  and Privacy Policy .
  • Tenant isolation is enforced server-side. Organization-scoped access checks and dedicated security tests cover reads and ingestion; your API key does not grant access to another organization’s data.
  • Retention follows your plan — 30 days on Free, longer on paid plans. Expired span data is hidden first, then permanently deleted after a 24-hour grace period, rather than archived. See Billing.

GDPR

  • Data export — GET /account/export returns your profile, connected social accounts, and billing history (Stripe identifiers themselves are excluded).
  • Deletion is asynchronous — DELETE /account returns 202 Accepted immediately and the deletion runs in the background.
  • Re-authentication — the request is refused unless you prove it is you: your password, or for an account that only signs in with Google or GitHub, a fresh sign-in with that provider.
  • Cascade order — cancel the subscription, delete the billing customer, delete your product-analytics record, delete your user account and everything tied to it, then settle the organizations you belonged to. Each step is wrapped independently so a failure in one doesn’t block the rest.
  • Organizations are not left behind — an org whose last member has gone is deleted with everything under it (workspaces, environments, API keys, traces and spans). An org that still has other members survives, and ownership passes to its longest-standing admin: erasure of your account cannot be made to wait on somebody else reassigning a workspace.
  • Consent — consent decisions are recorded as an append-only audit trail (one row per decision) and exposed through GET/PUT /account/consent.
  • Copilot — the agent these prompt-injection and output-classifier defenses protect.
  • Integrations — organization owners and admins manage redaction rules on the Redaction tab.
  • Settings — your account data controls.
Last updated on
MCPLimits