--- title: APM agent security: Node.js source: https://docs.newrelic.com/docs/apm/agents/nodejs-agent/getting-started/apm-agent-security-nodejs --- The New Relic Node.js agent default security settings automatically provide [security for your APM data](https://docs.newrelic.com/docs/using-new-relic/new-relic-security/security/apm-agent-data-security) to ensure data privacy and to limit the kind of information New Relic receives. You may have business reasons to change these settings. If you want to restrict the information that New Relic receives, you can enable [high-security mode](#restricted). If high-security mode or the default settings do not work for your business needs, you can apply [custom](#custom) settings. For more information about New Relic's security measures, see our [security and privacy documentation](https://docs.newrelic.com/docs/using-new-relic/new-relic-security/security/security-matters-data-privacy-new-relic), or visit the [New Relic security website](https://newrelic.com/security). ## Default security settings [#default] By default, here is how the Node.js agent handles the following potentially sensitive data: - Request parameters: The agent does not capture HTTP request parameters. If you wish to capture all request parameters, add `'request.parameters.*'` to [`attributes.include`](https://docs.newrelic.com/docs/agents/nodejs-agent/attributes/nodejs-agent-attributes#cfg-attributes-include) in your config file. - [HTTPS](https://docs.newrelic.com/docs/agents/nodejs-agent/installation-configuration/nodejs-agent-configuration#ssl): The agent communicates with New Relic using HTTPS. - [SQL](https://docs.newrelic.com/docs/agents/nodejs-agent/installation-configuration/nodejs-agent-configuration#record-sql): The agent sets SQL recording to `off`. When set to `off`, the agent does not capture slow queries and does not include backtraces or SQL in transaction traces. ## High-security mode settings [#restricted] When you [enable high-security mode](https://docs.newrelic.com/docs/agents/nodejs-agent/installation-configuration/nodejs-agent-configuration#high_security), the [default settings](#default) are locked so that users cannot change them. In addition: - The agent does not collect message queue parameters. - The `record_sql` configuration setting is changed to `obfuscated`, which strips out string and numeric literals. ## Custom security settings [#custom] > #### ⚠️ CAUTION > > If you customize security settings, it may impact the security of your application. If you need different security settings than default or high-security mode, you can customize these settings: - [Node.js agent configuration file](https://docs.newrelic.com/docs/agents/nodejs-agent/installation-configuration/nodejs-agent-configuration) - [Custom attributes](https://newrelic.github.io/node-newrelic/API.html#addCustomAttribute) - [Node.js agent API](<>)) | **Setting** | **Effects on data security** | | --------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [`audit_log.enabled`](https://docs.newrelic.com/docs/agents/nodejs-agent/installation-configuration/nodejs-agent-configuration#audit_log) _boolean_ | Default: `false` By default, the agent does not log all data sent to New Relic in the agent log file. If you set this to `true`, the agent logs the data sent to the New Relic collector in the agent log file. You can then evaluate the information that the agent sends by reviewing the agent log file to see if it includes sensitive information. | | [`high_security`](https://docs.newrelic.com/docs/agents/nodejs-agent/installation-configuration/nodejs-agent-configuration#high_security) _boolean_ | Default: `false` To enable [high-security mode](#restricted), set this to `true` and [enable high security in New Relic](https://docs.newrelic.com/docs/agents/manage-apm-agents/configuration/high-security-mode#version2enabled). This restricts the information you can send to New Relic. | | [`proxy_host`](https://docs.newrelic.com/docs/agents/nodejs-agent/installation-configuration/nodejs-agent-configuration#proxy_host) _string_ | Default: (none) Some proxies default to using HTTP, which is a less secure protocol. | | [`record_sql`](https://docs.newrelic.com/docs/agents/nodejs-agent/installation-configuration/nodejs-agent-configuration#record-sql) _string_ | Default: `off` By default, `record_sql` is set to `off`. If you enable [high-security mode](#restricted), this is automatically changed to `obfuscated`. You can change this setting to adjust the information that the agent sends to the New Relic collector. - If you do not want the agent to capture slow queries or to include backtraces and SQL in transaction traces, set this to `off`. - If you want the agent to strip out string and numeric literals, set this to `obfuscated`. - If you want the agent to capture all query information in its original form, set this to `raw`. |