An OpenTelemetry Collector processor that offloads LLM prompt and completion content to a secure vault, replacing sensitive data in traces with vault references.

Traces should contain references, not content. This processor:

1. Intercepts spans with LLM prompt/completion attributes
2. Writes the content to a storage backend (filesystem or S3)
3. Replaces the attribute value with a vault:// reference
4. Downstream systems see references, never raw content

processors:
  promptvault:
    storage:
      backend: filesystem
      filesystem:
        base_path: /data/vault
    vault:
      keys:
        - gen_ai.prompt
        - gen_ai.completion
        - gen_ai.system_instructions
      size_threshold: 0        # 0 = vault everything
      mode: replace_with_ref   # or "remove"

This processor is one component of the AIR Blackbox Gateway collector pipeline.

Apache-2.0