> ## Documentation Index
> Fetch the complete documentation index at: https://docs.appsignal.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Session data filtering

In most apps, at least some of the data that is sent to the application is sensitive or personally identifiable information that should not leave the network. To prevent AppSignal from storing this data the Elixir package should be configured to not send this data at all or filter out specific values.

In web applications sessions can be used to store user preferences and other sensitive data without it having to be persisted in the database or sent using [parameters](/application/parameter-filtering).

In Phoenix applications AppSignal automatically stores the contents of the user's session on the AppSignal transaction. This can be disabled or specific values can be filtered out.

<Warning>
  🔐 Do not send <strong>Personal Identifiable Information (PII)</strong> to AppSignal. Filter PII (e.g., names, emails) and use an ID, hash, or pseudonymized identifier instead. <br /> <br /> For <strong>HIPAA-covered entities</strong>, more info on signing a Business Associate Agreement (BAA) is available in our <a href="/support/business-add-ons">Business Add-Ons documentation</a>.
</Warning>

<Tip>
  This feature is available since AppSignal Elixir package [version
  1.6.0](https://blog.appsignal.com/2018/05/08/elixir-integration-1-6.html).
</Tip>

<h2 id="appsignal-session-data-filtering">
  AppSignal session data filtering
</h2>

Session data filtering will filter out any values from specified keys in the [`filter_session_data`](/elixir/configuration/options#option-filter_session_data) configuration option. Any filtered out value will be replaced with `[FILTERED]` before it leaves your application and is sent to the AppSignal servers. This means that AppSignal never receives any of the filtered data.

In the session data filtering, there's support for nested hashes and nested hashes in arrays. Any hash we encounter in your session data will be filtered.

To use this filtering, add the following to your `config/appsignal.exs` file in the environment group you want it to apply. The [`filter_session_data`](/elixir/configuration/options#option-filter_session_data) value is an Array of Strings.

<CodeGroup>
  ```elixir Elixir theme={null}
  # config/appsignal.exs
  config :appsignal, :config,
    filter_session_data: ["name", "email", "api_token", "token"]
  ```
</CodeGroup>

<h2 id="send-session-data">
  Send session data
</h2>

<Warning>
  **Warning**: The `skip_session_data` option is deprecated since AppSignal
  Elixir package 2.2.10. Set [`send_session_data`](/elixir/configuration/options#option-send_session_data) option to `false` instead to not send any session data with exception and performance traces. For more information please read about [request session data filtering](/application/session-data-filtering).
</Warning>

<CodeGroup>
  ```elixir Elixir theme={null}
  # config/appsignal.exs
  # Session data is sent by default. Set this to false to stop sending it
  config :appsignal, :config,
    send_session_data: true
  ```
</CodeGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.