Skip to main content
The Data security group of Settings holds Cipher keys, Regex patterns, Field masking, Domain management, and Audit. Reading the first four requires org.settings.read, and changing them requires org.settings.manage. Audit requires audit.read. The retention of audit records is a platform setting.

​
Cipher keys

Cipher keys lists the data keys of the workspace, with the algorithm, the version, and the time of the last rotation. MoleSignal creates the key of encrypted fields by itself the first time a stream writes one; it appears as __field_default__. Every key is wrapped with the cipher root key MS_CIPHER_KEY, and its material never leaves the server.
Losing MS_CIPHER_KEY makes every encrypted field unrecoverable. See Field-level encryption.

​
Regex patterns

A regex pattern finds sensitive text, such as card numbers or tokens, and replaces it.
  1. Select New pattern.
  2. Enter a Name, the Pattern, and a Description. The server checks the pattern when it is saved.
  3. Enter the Replacement. $1 and other capture groups work, and an empty replacement deletes the match.
  4. Choose where it applies with Redact on intake, then select Create.
mask() applies every pattern of the workspace. The Masking column of the list shows On intake or Query-only for each pattern.

​
Field masking

Field masking hides parts of field values in query results, while queries still compute on the raw values. It never applies to metrics streams.
  1. Select New rule and enter a Rule name.
  2. Field match: an exact field name, or a name with * and ? wildcards such as user.*. Regular expressions are not accepted.
  3. Optionally narrow it with Stream match, for example customer-*, and Stream type.
  4. Choose the Algorithm, keep Enable rule on, and save.
The first enabled rule that matches a field wins. Drag rows to change the order. The field settings of a stream can override the inherited rule or turn masking off for a field.

​
Domain management

Domain management serves the workspace under a hostname of its own, with a certificate that MoleSignal obtains and renews.
  1. Enable [http.tls] with an account_email. See HTTP TLS and ACME.
  2. Point the DNS of the hostname at MoleSignal, so that the ACME service reaches /.well-known/acme-challenge/ on the plain HTTP port.
  3. Select Add domain, enter the Hostname, and select Add domain.
The list shows the State of each hostname, the expiry of its certificate, and the Last error. A new hostname waits as pending until the certificate is issued, and becomes active. Certificates renew by themselves within 30 days of expiry. Removing a hostname stops serving it.

​
Audit

Audit searches the audit trail of the workspace: security-relevant actions and changes to resources and settings, each with the actor, the action, the target, the status, and the time. Select Apply to search and Reset to clear the filters. Select a row to see the whole event and Copy id. An event of a Mole Agent chat shows the history of that chat. The head of the page says how long records are kept; Change retention opens the platform setting in _sys. Credentials, model keys, sensitive webhook headers, and signing material never appear in audit records. See Audit.
Last modified on October 26, 2026