> ## Documentation Index > Fetch the complete documentation index at: https://docs.molesignal.com/llms.txt > Use this file to discover all available pages before exploring further. # Data security settings > Manage the data keys of encrypted fields, redact sensitive text with regex patterns, mask fields in query results, serve custom domains, and search the audit trail. The **Data security** group of **Settings** holds **Cipher keys**, **Regex patterns**, **Field masking**, **Domain management**, and **Audit**. Reading the first four requires `org.settings.read`, and changing them requires `org.settings.manage`. **Audit** requires `audit.read`. The retention of audit records is a [platform setting](https://docs.molesignal.com/en-US/settings/platform.md#audit-retention). ## Cipher keys **Cipher keys** lists the data keys of the workspace, with the algorithm, the version, and the time of the last rotation. MoleSignal creates the key of [encrypted fields](https://docs.molesignal.com/en-US/streams.md#encrypted-fields) by itself the first time a stream writes one; it appears as `__field_default__`. Every key is wrapped with the cipher root key `MS_CIPHER_KEY`, and its material never leaves the server. | Action | How | | - | - | | **New key** | Enter a **Name** and 32 bytes of key material encoded in base64 (`key_material_b64`). | | **Rotate** | Paste new 32-byte key material in base64. Rotation adds a version: new data uses it, and the older versions still decrypt what they encrypted. | | Delete | Data encrypted with the key becomes unreadable. | > [!WARNING] > > Losing `MS_CIPHER_KEY` makes every encrypted field unrecoverable. See > [Field-level encryption](https://docs.molesignal.com/en-US/security.md#field-level-encryption). ## Regex patterns A regex pattern finds sensitive text, such as card numbers or tokens, and replaces it. 1. Select **New pattern**. 2. Enter a **Name**, the **Pattern**, and a **Description**. The server checks the pattern when it is saved. 3. Enter the **Replacement**. `$1` and other capture groups work, and an empty replacement deletes the match. 4. Choose where it applies with **Redact on intake**, then select **Create**. | **Redact on intake** | Effect | | - | - | | On | Every string value of every incoming event is redacted after the pipelines and before it is stored. The original text is gone for good. | | Off | Stored data keeps the original. A query that calls `mask()` in SQL gets the column with the patterns applied. | `mask()` applies every pattern of the workspace. The **Masking** column of the list shows **On intake** or **Query-only** for each pattern. ## Field masking Field masking hides parts of field values in query results, while queries still compute on the raw values. It never applies to metrics streams. 1. Select **New rule** and enter a **Rule name**. 2. **Field match**: an exact field name, or a name with `*` and `?` wildcards such as `user.*`. Regular expressions are not accepted. 3. Optionally narrow it with **Stream match**, for example `customer-*`, and **Stream type**. 4. Choose the **Algorithm**, keep **Enable rule** on, and save. | Algorithm | Effect | | - | - | | **Full mask** | Replaces the whole value with the **Replacement**. | | **Range mask** | Masks the characters from **Start character** up to **End character (exclusive)**. | | **Inner mask** | Keeps a number of **Visible prefix characters** and **Visible suffix characters**, and masks the middle. | | **Outer mask** | Keeps only the characters from **Start character** to **End character (exclusive)**, and masks both sides. | | **HMAC-SHA-256 hash** | Replaces the value with a digest made with a key of the workspace that the server manages. The same value gives the same digest, so results can still be grouped and joined. | The first enabled rule that matches a field wins. Drag rows to change the order. The field settings of a [stream](https://docs.molesignal.com/en-US/streams.md#schema-and-fields) can override the inherited rule or turn masking off for a field. ## Domain management **Domain management** serves the workspace under a hostname of its own, with a certificate that MoleSignal obtains and renews. 1. Enable `[http.tls]` with an `account_email`. See [HTTP TLS and ACME](https://docs.molesignal.com/en-US/configuration.md#http-tls-and-acme). 2. Point the DNS of the hostname at MoleSignal, so that the ACME service reaches `/.well-known/acme-challenge/` on the plain HTTP port. 3. Select **Add domain**, enter the **Hostname**, and select **Add domain**. The list shows the **State** of each hostname, the expiry of its certificate, and the **Last error**. A new hostname waits as `pending` until the certificate is issued, and becomes `active`. Certificates renew by themselves within 30 days of expiry. Removing a hostname stops serving it. ## Audit **Audit** searches the audit trail of the workspace: security-relevant actions and changes to resources and settings, each with the actor, the action, the target, the status, and the time. | Filter | Use | | - | - | | **From** / **To** | The time range, absolute or relative such as `now-24h`. | | **Actor kind** / **Actor** | A kind of actor, or one user. | | **Action** | An action key, such as `audit_retention.update`. | | **Target kind** / **Target id** | The kind and the ID of the changed resource. | Select **Apply** to search and **Reset** to clear the filters. Select a row to see the whole event and **Copy id**. An event of a Mole Agent chat shows the history of that chat. The head of the page says how long records are kept; **Change retention** opens the platform setting in `_sys`. Credentials, model keys, sensitive webhook headers, and signing material never appear in audit records. See [Audit](https://docs.molesignal.com/en-US/security.md#audit). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.