The stable token part is interesting. It solves something that simple redaction doesn't, since you can still tell that the same value appeared in multiple logs.

The stable token part is interesting. It solves something that simple redaction doesn't, since you can still tell that the same value appeared in multiple logs. But I wonder if there's a trade-off here: repeated tokens also reveal that two events are related, even though the original value is hidden. For example, you could still see that the same user/email/customer appears many times. Do you see this being handled with different keys/scopes for different datasets or tenants, or is the assumption that correlation across the whole dataset is desirable?