It can, but only after you decide what the tracker is allowed to capture and review the vendor like any other that may touch sensitive data. Error tools often attach request details, local variables and user context by default. Scrub before sending, strip payloads, and check the contract and settings.
What a tracker actually sends
An exception report is richer than a log line. Depending on the tool and its settings, it can include the stack trace, the failing request URL and headers, form fields, local variable values, user identifiers and breadcrumbs of recent actions. In a health app, any of those can hold patient information.
The OWASP Logging Cheat Sheet is short on this point: perform due diligence checks before sending event data to third parties. The same sheet warns that sensitive data should be removed, masked, hashed or encrypted before logging.
Decision guide
| Question | If yes | If no |
|---|---|---|
| Can you disable payload and variable capture? | Do it, then proceed | Pick another tool or self host |
| Can you scrub fields before they leave your network? | Use a before send hook | Do not send raw events |
| Does the vendor offer a signed agreement suited to health data? | Ask your counsel whether you need it | Treat events as non sensitive only |
| Can you set short retention and delete on request? | Set the shortest workable period | Reconsider |
Whether a vendor needs a business associate agreement is a legal question about your facts. Ask your counsel. This post is not legal advice.
Steps to adopt one safely
- Name an owner for the tool and an approver for configuration changes.
- Turn off default capture of request bodies, cookies, headers and local variables.
- Replace user identifiers with opaque IDs before sending.
- Add a scrubbing hook that drops fields not on an allowlist.
- Send a test error from a staging build that contains fake sensitive values and check what arrives.
- Set retention, restrict who can open events, and enable single sign on.
- Re-run step 5 after every major SDK upgrade, because defaults change.
Mobile and browser SDKs
SDKs running in the app have wide visibility. Treat the SDK as a dependency with its own review: what version, what permissions, what network destinations. A client side SDK also adds to your supply chain, so update it on a schedule and watch advisories.
Where Safeguard fits
Safeguard scans dependencies, including SDKs you add for monitoring, and can apply policies so new packages are reviewed before they ship. That covers the supply chain side. Your scrubbing rules and vendor decision remain yours. Try the free scan at gold.safeguard.sh/scan.
Quick check
Is a stack trace safe to send?
Often yes, but only if it contains no variable values or request data. Check a real sample.
Can we skip the vendor review for a free tier?
No. A free tier still receives your data. The review depends on what is sent, not on price.
Sources
Last reviewed: 19 October 2026.
