# RUM Redaction and Masking

Data redaction permanently removes sensitive information, making it irretrievable. Data masking temporarily disguises it with fake data for controlled use. Both techniques are vital for cybersecurity, protecting sensitive information and ensuring compliance with data privacy regulations.

## Web RUM

Use the following options on the SDK to control the captured data.

PII data may be captured in two places; each have separate approaches for restricting what data to capture:

- As attributes of RUM events like `view.url_path` or `action.name`
- As visual capture during session recording

The scenarios where PII could appear in RUM Events are:

- [Action names](https://docs.kloudfuse.com/platform/3.2.5/rum-redaction-masking/#action-names) on buttons
- Names in URLs
- Sensitive information captured during session recording

### RUM Action Names

RUM action names derive from information in the DOM, such as labels and so on.

To control action names, configure `enablePrivacyForActionName` on RUM SDK. Setting `enablePrivacyForActionName` to `true` defaults the action names to `Masked Element`, unless the element or its parent has a specific DOM attribute `data-dd-action-name="My Custom Action Name"`.

```javascript
kfuseRumSDK.init({
  config: {
    ...
    enablePrivacyForActionName: true,
  },
});
```

### Modify Event Attributes

You can modify all events before they leave the browser, by attaching a `beforeSend` hook. This hook function receives the RUM event object for you to modify as required. For example, if any URL contains PII or ids, you can use this method to sanitize those attributes.

To enable the `beforeSend` hook, implement the `kfuseRumSDK` function in your code:

```javascript
kfuseRumSDK.init({
  config: {
    ...
    beforeSend: function(event, context) {
	if (event.type == "view") { (1)
		event.view.url = removePIIFromURL(event.view.url) (2)
	}
	return true (3)
    },
  },
});
```

|     |     |
| --- | --- |
| **1** | Add code to modify the event |
| **2** | `removePIIFromURL`: Custom function to remove PII |
| **3** | Return `true` to send the modified event. Return `false` to drop the event itself. |

For more information, see Datadog documentation on [Event and context structure](https://docs.datadoghq.com/real_user_monitoring/guide/enrich-and-control-rum-data/?tab=event#event-and-context-structure).

### Redaction in Session Replay

|     |     |
| --- | --- |
|  | Using this approach ignores the Datadog SDK configuration attribute `defaultPrivacyLevel`. |

To control redaction and masking in session replay, annotate your HTML with one of the RRWeb class names: `.rr-block`, `.rr-ignore`, or `.rr-mask`.

For more information, see RRWeb documentation on [Privacy](https://github.com/rrweb-io/rrweb/blob/master/guide.md#privacy).