Data handling
Data handling is a Settings tab at /settings/data-handling, between Integrations and Outcomes.
It gathers what Morse has seen about how your agents’ data is handled into one page, so you can
answer a customer’s or auditor’s question without assembling it from five screens. Every member of
the workspace can read it; only owners and admins can change anything on it.
Observed, not attested
Everything on the page is something Morse measured from the traces it received. It is evidence, not a certification and not a promise about what your systems do when Morse is not looking. Three consequences:
- A figure is a count of what Morse saw in a stated window, with the date it was computed. It says nothing about traffic that never reached Morse.
- Morse records the verdicts your own guardrails return. It does not run guardrails for you, and it does not judge whether a guardrail is good enough.
- A section Morse has nothing to look at shows Not measured, never zero. “0 redactions in 30 days” means Morse looked and found none; “Not measured” means there was no data to look at.
What you see
The sections, top to bottom (and in the same order on a phone).
Redaction config
The patterns Morse always redacts, the optional ones your workspace has switched on, and how many custom patterns you have added. This is a setting, not a measurement, so it is always shown. Change it in Workspace settings, under Data & privacy. What the patterns cover is listed in PII redaction.
Guardrail coverage
For each agent over the last 7 days: how many runs there were, how many of them carried at least one guardrail verdict, the share of runs that is, how often a verdict was a flag, a redaction or a block (the trip rate), and how that compares with the 7 days before. An agent with fewer than 20 runs reads “Too few runs to measure” instead of a percentage. An agent with enough runs and no verdict at all reads “No guardrail seen”. How verdicts get in is on Guardrail verdicts.
Redactions
Counts over the last 30 days of values replaced with a tag before they were stored, split into those your SDK redacted in your process and those Morse redacted on arrival, by tag, with the agents that had the most. See Redaction evidence.
New tools and MCP servers
Tools and MCP servers an agent used for the first time in the last 30 days. See Tools first seen.
Imported test runs
The latest promptfoo and garak result file you uploaded, with passed and failed counts and the top categories. See Imported test runs.
Retention and hosting
How long your plan keeps trace data, the region it is hosted in, and how long database backups take to age out (90 days). The backup figure matters for erasure: see End-user erasure.
Erasure requests
Requests to erase one end user’s data, with their status in each store. Owners and admins can start one here. See End-user erasure.
Share a read-only summary
Owners and admins on a paid plan can create a link to a read-only copy of this page, for example to send to a customer who asked how you handle data.
- What the link shows. A snapshot of the aggregate figures above, taken when you create the link, with your workspace name and the snapshot date. It carries no trace, span or end-user ids, no prompts or outputs, and no tool arguments. The only names in it are your agent names and tool names.
- What the viewer sees. The line “Observed by Morse, not attested”, the snapshot date, and a Morse attribution footer. Viewing needs no account and costs nothing.
- Expiry. A link expires 30 days after you create it. The snapshot does not update; create a new link for fresher figures.
- Revoking. You can revoke a link at any time. An expired, revoked or mistyped link all show the same not-found page.
- Plans. Creating a link is a paid-plan feature. On the Free plan the action is not shown; the rest of the page is.
Before you have data
With no traces, every measured section reads Not measured and the page points you to send your first trace. The redaction config and retention sections are settings, so they always show.
Related
- Guardrail verdicts
- Redaction evidence
- Tools first seen
- Imported test runs
- End-user erasure
- System prompt repeated in output
- PII redaction and GDPR controls — the redaction patterns, retention and account-level GDPR controls.