Security — Data Minimization (Field Allowlist)

This is the explicit, authoritative list of every field Maya ingests. Anything not on this list is not ingested. The list is designed to be small, machine-checkable, and copy-pasteable into a filter query.

Allowlisted fields

All other fields are dropped at source. The filter query produces only the fields above. Anything else in the raw log is never transmitted.

Verified LLM bot allowlist

The user_agent field is filtered against this allowlist. Patterns are case-insensitive substring matches.

GPTBot
ChatGPT-User
OAI-SearchBot
ClaudeBot
Claude-Web
anthropic-ai
PerplexityBot
Perplexity-User
Google-Extended
Googlebot
Bingbot
Applebot-Extended
Bytespider
CCBot
Meta-ExternalAgent
FacebookBot
DuckAssistBot
YouBot
Amazonbot
Diffbot

This list is versioned. Maya publishes updates monthly. The brand controls when to adopt updates.

Note: Googlebot and Bingbot are included because Gemini and Copilot use grounded search through these crawlers. The brand may choose to exclude them if non-LLM search traffic should be scoped out.

Forbidden fields (never produced by the filter)

The filter query MUST NOT include any of the following:

• Raw IP address (only client_ip_hash may be transmitted, and only if the brand opts in)
• Cookie header (any cookies)
• Authorization header
• Set-Cookie response header
• POST/PUT request body
• Query string parameters that may contain PII (the filter strips email, tckn, phone, customer_id, account_id, session, token, key, secret and any parameter the brand adds to its denylist)
• Form data
• Any header containing csrf, session, token, auth
• TCKN, customer numbers, account numbers (in any field)

Minimization in practice

The brand-side filter applies, in order:

1. Pre-filter — drop traffic outside the user-agent allowlist (most rows discarded here).
2. Field projection — produce only the allowlisted fields above.
3. Sensitive-key strip — for request_path, strip query-string keys on the denylist.
4. Hashing — if client_ip_hash is enabled, hash with HMAC-SHA256 using a per-tenant secret held by the brand.

Reference implementations:

• IIS / PowerShell
• Nginx (coming soon)
• Apache (coming soon)
• Custom BFF endpoint (coming soon)

Validating the filter

Before deploying the filter to production, the brand should:

1. Run it in --dry-run mode for a 24h sample.
2. Diff the output schema against the allowlist above. There must be no extra fields.
3. Spot-check 100 random rows to confirm no PII or denylisted content slipped through.
4. Sign off the query in your change management system.

Maya can assist with the validation but does not need access to the raw log to do so.