--- title: APM agent security: Python source: https://docs.newrelic.com/docs/apm/agents/python-agent/getting-started/apm-agent-security-python --- The Python agent default security settings automatically provide [security for your data](https://docs.newrelic.com/docs/using-new-relic/new-relic-security/security/apm-agent-data-security) to ensure data privacy and to limit the kind of information we ingest. You may have business reasons to change these settings. If you want to restrict the information that we ingest you can enable [high-security mode](#restricted). If high-security mode or the default settings do not work for your business needs, you can apply [custom](#custom) settings. For more information about security measures, see our [security and privacy documentation](https://docs.newrelic.com/docs/using-new-relic/new-relic-security/security/security-matters-data-privacy-new-relic), or visit the [New Relic security website](https://newrelic.com/security). ## Default security settings [#default] By default, here is how the Python agent handles the following potentially sensitive data: - [Request parameters](https://docs.newrelic.com/docs/agents/python-agent/attributes/python-attribute-examples#ex_req_params): The agent does not capture HTTP request parameters. - [SQL](https://docs.newrelic.com/docs/agents/python-agent/installation-configuration/python-agent-configuration#txn-tracer-sql): The agent sets SQL recording to `obfuscated`, which removes the potentially sensitive numeric and string literal values. ## High-security mode settings [#restricted] When you [enable high-security mode](https://docs.newrelic.com/docs/agents/python-agent/installation-configuration/python-agent-configuration#high_security), the [default settings](#default) are locked so that users cannot change them. In addition: - The agent does not collect [message queue parameters](https://docs.newrelic.com/docs/agents/python-agent/api/python-agent-api-guide#messaging). - You cannot create [custom events](https://docs.newrelic.com/docs/agents/python-agent/python-agent-api/record_custom_event). - The agent strips [exception messages from errors](https://docs.newrelic.com/docs/agents/python-agent/installation-configuration/python-agent-configuration#strip_exception_messages_enabled). ## Custom security settings [#custom] > #### ⚠️ CAUTION > > If you customize security settings, it may impact the security of your application. If you need different security settings than default or high-security mode, you can customize these settings: - [Python agent configuration file](https://docs.newrelic.com/docs/agents/python-agent/installation-configuration/python-agent-configuration) - [Custom attributes](https://docs.newrelic.com/docs/agents/python-agent/python-agent-api/add_custom_attribute) - [Python agent API](https://docs.newrelic.com/docs/agents/python-agent/api/python-agent-api-guide) > #### 💡 TIP > > Some of these settings can be changed using environment variables. See [Python agent environment variables](https://docs.newrelic.com/docs/agents/python-agent/installation-configuration/python-agent-configuration#environment-variables) for the complete list. | **Setting** | **Effects on data security** | | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [`audit_log_file`](https://docs.newrelic.com/docs/agents/python-agent/installation-configuration/python-agent-configuration#audit-log-file) _string_ | Default: (none) If you use this to set the name of the audit log file, the agent will log details of messages passed back and forth between the monitored process and the data collector. You can then evaluate the information that the agent sends to the collector to see if it includes sensitive information. | | [`high_security`](https://docs.newrelic.com/docs/agents/python-agent/installation-configuration/python-agent-configuration#high_security) _boolean_ | Default: `false` To enable [high-security mode](#restricted), set this to `true` and [enable high security](https://docs.newrelic.com/docs/agents/manage-apm-agents/configuration/high-security-mode#version2enabled). This restricts the information you can send. | | [`proxy_host`](https://docs.newrelic.com/docs/agents/python-agent/installation-configuration/python-agent-configuration#proxy) _string_ | Default: (none) Some proxies default to using HTTP, which is a less secure protocol. | | [`attributes.enabled`](https://docs.newrelic.com/docs/agents/python-agent/installation-configuration/python-agent-configuration#cfg-attributes-enabled) _boolean_ | Default: `true` By default, you are sending [attributes](https://docs.newrelic.com/docs/agents/python-agent/attributes/enabling-disabling-attributes-python). If you do not want to send attributes, set this to `false`. | | [`attributes.exclude`](https://docs.newrelic.com/docs/agents/python-agent/installation-configuration/python-agent-configuration#cfg-attributes-exclude) _string_ | Default: (none) If there are specific attribute keys that you do **not** want to send in transaction traces, identify them using `attributes.exclude`. This restricts the information sent. Consider if you want to exclude these potentially sensitive attributes using `attributes.exclude` or if you need the information sent: - `request.headers.*`: Removes all request headers. (Note that HTTP headers that contain sensitive data such as `cookie` and `authorization` are never collected.) - `response.headers.*`: Removes all response headers. | | [`custom_insights_events.enabled`](https://docs.newrelic.com/docs/agents/python-agent/configuration/python-agent-configuration#custom-insights-events-settings) _boolean_ | Default: `true` By default, the agent records events sent to the Event API via [`record_custom_event()`](https://docs.newrelic.com/docs/agents/python-agent/api/python-agent-api-guide#record_custom_event). If you enable [high-security mode](#restricted), this is automatically set to `false`. | | [`transaction_tracer.record_sql`](https://docs.newrelic.com/docs/agents/python-agent/installation-configuration/python-agent-configuration#txn-tracer-sql) _string_ | Default: `obfuscated` By default, `transaction_tracer.record_sql` is set to `obfuscated`, which strips out the numeric and string literals. - If you do not want the agent to capture query information, set this to `off`. - If you want the agent to capture all query information in its original form, set this to `raw`. - When you enable [high-security mode](#restricted), this is automatically set to `obfuscated`. | | [`strip_exception_messages.enabled`](https://docs.newrelic.com/docs/agents/python-agent/installation-configuration/python-agent-configuration#strip_exception_messages_enabled) _boolean_ | Default: `false` If you enable [high-security mode](#restricted), this is automatically set to `true`. If you are not using high-security mode but want to strip messages from all exceptions except those in your [allow list](https://docs.newrelic.com/docs/agents/python-agent/configuration/python-agent-configuration#strip_exception_messages_whitelist), set this to `true`. |