Body Retention Modes
Control whether request and response bodies are stored — for privacy, compliance, or cost.
Body Retention Modes
Control whether request and response bodies are stored — for privacy, compliance, or cost.
Tier: Body retention is a non-free feature (Growth tier or higher).
Modes
| Mode | What's Stored | When to Use |
|---|---|---|
full | Full request + response bodies in S3 | Debugging, replay, audit |
metadata_only | Metadata only (no bodies) | Privacy-sensitive workloads |
none | No body storage | Maximum privacy / compliance |
Default
Body retention defaults to OFF (fail-closed for privacy). When disabled, only metadata is logged — no request or response bodies are stored.
Configuration
Body retention is configured at the org level via the CoreValue dashboard or API. The gateway checks the org's body_retention_enabled setting on each request.
What Gets Stored
- When enabled: Request and response bodies uploaded to S3/GCS object storage. Metadata logged to analytics.
- When disabled: Bodies not stored. Only metadata (model, tokens, cost, user_id, properties) is logged.
Privacy Implications
For GDPR/CCPA compliance, disable body retention. The gateway still tracks cost and usage metadata without storing the actual content of requests.
Related: PII Scanning masks sensitive data even when body retention is enabled.