Security And Privacy

Morse AI ingests and displays LLM traffic, so its threat model includes the LLM-specific risks a generic APM tool doesn’t have to think about — alongside the redaction and GDPR controls you’d expect from any platform holding customer data.

Prompt-injection and output defenses

Morse’s own Copilot is an LLM agent with access to your trace data, so it’s scanned like one.

• Prompt-injection scanning — every Copilot input is checked before it reaches a model. Detected attempts are logged (as a hash of the message, never the raw content) rather than silently dropped.
• Output classifier — every Copilot response is checked after generation for system-prompt leaks, hallucinated data (three or more UUIDs that don’t trace back to real records), and redirects to a domain outside an explicit allowlist.
• Canary tokens — a marker is embedded in the system prompt Copilot is built from; if a response ever echoes it back, the output classifier’s system-prompt-leak check catches it.
• Second-order injection defense — trace and span content that an eval judge or Copilot tool call reads is never trusted as instructions. It’s wrapped in <untrusted_trace_data> delimiters before it reaches any judge or tool-result-handling LLM call, closing the path where a malicious string recorded inside a trace could hijack a later model call that reads it back.

PII redaction

Redaction runs on both sides:

• Mandatory server-side redaction — a fixed set of patterns is always applied before spans, metrics, and logs are persisted.
• Customer-configurable regex — orgs can add their own redaction patterns on top of the mandatory set, resolved per-org with a short-lived cache.

The Python and TypeScript SDKs apply the same pattern set client-side before a span ever leaves your process, and a parity test keeps both implementations in sync with the server.

GDPR

• Data export — GET /account/export returns your profile, connected social accounts, and billing history (Stripe identifiers themselves are excluded).
• Deletion is asynchronous — DELETE /account returns 202 Accepted immediately and queues a Celery task rather than deleting inline.
• Cascade order — cancel the Stripe subscription, delete the Stripe customer, delete the PostHog person record, then delete the Django user (which cascades to related tables via FK). Each step is wrapped independently so a failure in one doesn’t block the rest.
• Consent — consent decisions are recorded as an append-only audit trail (one row per decision) and exposed through GET/PUT /account/consent.

Related

• Copilot — the agent these prompt-injection and output-classifier defenses protect.
• Settings — where org-level redaction rules and account data controls live.