Groq Data Handling
Overview
Manage data flowing through Groq's inference API. This skill wires a privacy
pipeline around the Groq SDK: sanitize prompts before they are sent, filter
responses after they return, redact PII, hash-log an audit trail, and track
token usage and cost. Key fact: Groq does not use API data for model training
(Groq Privacy Policy).
Prerequisites
- Node.js project with the
groq-sdk package installed (npm i groq-sdk).
- A Groq API key exported as
GROQ_API_KEY. The SDK reads it automatically
from the environment — new Groq() needs no explicit argument. Never hardcode
the key; keep it in an untracked .env or your secret manager.
- Node's built-in
crypto module (for the audit hash) — no install needed.
Instructions
The pipeline layers in four stages; drop simple add-ons (moderation, cost
reporting) on top. Each snippet below is the skeleton — the full, copy-ready
code for every stage is in references/implementation.md.
Sanitize input — run a PII rule table over every message before it
leaves your process, flagging which categories were caught:
function sanitizeMessages(messages: any[]): { messages: any[]; hadPII: boolean } {
// apply PII_RULES to each message's content; return redacted copy + flag
}
Wrap the completion call — call safeCompletion(...) instead of the raw
groq.chat.completions.create, so input and response both pass the sanitizer.
Track usage — trackUsage(model, completion.usage, sessionId) records
token counts and estimated cost per call using a per-model price table.
Audit — auditedCompletion(...) ties it together and logs a SHA-256
hash of the prompt (never the prompt text) so the audit trail carries no
sensitive content.
For content moderation via Llama Guard and a daily cost report, see
references/examples.md.
Groq data policy
- Groq does not train on API request/response data.
- Prompts and completions are processed and discarded.
- Groq may temporarily log requests for abuse prevention.
- For enterprise: contact Groq for DPA and SOC 2 compliance details.
Output
- Sanitized messages/responses — text with
[EMAIL], [PHONE], [SSN],
[CARD], [IP] placeholders swapped in for detected PII, plus a hadPII
boolean and a list of redacted categories.
- Usage records — one JSON line per call (
type: "groq_usage") with model,
token counts, and estimatedCostUsd.
- Audit entries — one JSON line per call (
type: "groq_audit") carrying a
prompt hash, piiDetected, responseFiltered, and the usage record.
- Cost report — an aggregated object with
totalCost, totalTokens,
totalCalls, and a per-model breakdown (see the sample in
references/examples.md).
Error Handling
| Issue |
Cause |
Solution |
| PII leaks in response |
Model echoes sensitive input |
Apply response filtering on all completions |
| Cost spike |
70B model for all requests |
Route simple tasks to 8B |
| Missing usage data |
Streaming mode |
Use non-streaming for tracked requests, or estimate |
| Audit gaps |
Not all code paths use wrapper |
Lint rule: ban direct groq.chat.completions.create |
GROQ_API_KEY not set |
Key missing from environment |
Export the key before running; the SDK throws on an unauthenticated call |
Examples
- Full four-stage pipeline (sanitizer, safe wrapper, usage tracker,
audited completion) — references/implementation.md.
- Content safety check with Llama Guard and a daily cost report —
references/examples.md.
Minimal end-to-end use once the helpers are in place:
const { content, audit } = await auditedCompletion(sessionId, messages);
// content is PII-filtered; audit is a hash-only record safe to persist
Resources
For enterprise access controls, see the groq-enterprise-rbac skill.
1---2name: groq-data-handling3description: Use when you need to keep PII out of Groq API calls, filter model responses, audit-log conversations, or track token cost and usage for a Groq integration. Implements prompt sanitization, PII redaction, response filtering, and usage tracking. Trigger with phrases like "groq data", "groq PII", "groq GDPR", "groq data retention", "groq privacy", "groq compliance".4license: MIT5---6# Groq Data Handling
7
8## Overview
9
10Manage data flowing through Groq's inference API. This skill wires a privacy
11pipeline around the Groq SDK: sanitize prompts before they are sent, filter
12responses after they return, redact PII, hash-log an audit trail, and track
13token usage and cost. Key fact: Groq does not use API data for model training
14([Groq Privacy Policy](https://groq.com/privacy-policy/)).
15
16## Prerequisites
17
18- Node.js project with the `groq-sdk` package installed (`npm i groq-sdk`).
19- A Groq API key exported as `GROQ_API_KEY`. The SDK reads it automatically
20 from the environment — `new Groq()` needs no explicit argument. Never hardcode
21 the key; keep it in an untracked `.env` or your secret manager.
22- Node's built-in `crypto` module (for the audit hash) — no install needed.
23
24## Instructions
25
26The pipeline layers in four stages; drop simple add-ons (moderation, cost
27reporting) on top. Each snippet below is the skeleton — the full, copy-ready
28code for every stage is in [references/implementation.md](references/implementation.md).
29
301. **Sanitize input** — run a PII rule table over every message before it
31 leaves your process, flagging which categories were caught:
32
33 ```typescript
34 function sanitizeMessages(messages: any[]): { messages: any[]; hadPII: boolean } {
35 // apply PII_RULES to each message's content; return redacted copy + flag
36 }
37 ```
38
392. **Wrap the completion call** — call `safeCompletion(...)` instead of the raw
40 `groq.chat.completions.create`, so input and response both pass the sanitizer.
41
423. **Track usage** — `trackUsage(model, completion.usage, sessionId)` records
43 token counts and estimated cost per call using a per-model price table.
44
454. **Audit** — `auditedCompletion(...)` ties it together and logs a SHA-256
46 hash of the prompt (never the prompt text) so the audit trail carries no
47 sensitive content.
48
49For content moderation via Llama Guard and a daily cost report, see
50[references/examples.md](references/examples.md).
51
52### Groq data policy
53
54- Groq does **not** train on API request/response data.
55- Prompts and completions are processed and discarded.
56- Groq may temporarily log requests for abuse prevention.
57- For enterprise: contact Groq for DPA and SOC 2 compliance details.
58
59## Output
60
61- **Sanitized messages/responses** — text with `[EMAIL]`, `[PHONE]`, `[SSN]`,
62 `[CARD]`, `[IP]` placeholders swapped in for detected PII, plus a `hadPII`
63 boolean and a list of redacted categories.
64- **Usage records** — one JSON line per call (`type: "groq_usage"`) with model,
65 token counts, and `estimatedCostUsd`.
66- **Audit entries** — one JSON line per call (`type: "groq_audit"`) carrying a
67 prompt hash, `piiDetected`, `responseFiltered`, and the usage record.
68- **Cost report** — an aggregated object with `totalCost`, `totalTokens`,
69 `totalCalls`, and a per-model breakdown (see the sample in
70 [references/examples.md](references/examples.md)).
71
72## Error Handling
73
74| Issue | Cause | Solution |
75|-------|-------|----------|
76| PII leaks in response | Model echoes sensitive input | Apply response filtering on all completions |
77| Cost spike | 70B model for all requests | Route simple tasks to 8B |
78| Missing usage data | Streaming mode | Use non-streaming for tracked requests, or estimate |
79| Audit gaps | Not all code paths use wrapper | Lint rule: ban direct `groq.chat.completions.create` |
80| `GROQ_API_KEY` not set | Key missing from environment | Export the key before running; the SDK throws on an unauthenticated call |
81
82## Examples
83
84- **Full four-stage pipeline** (sanitizer, safe wrapper, usage tracker,
85 audited completion) — [references/implementation.md](references/implementation.md).
86- **Content safety check** with Llama Guard and a **daily cost report** —
87 [references/examples.md](references/examples.md).
88
89Minimal end-to-end use once the helpers are in place:
90
91```typescript
92const { content, audit } = await auditedCompletion(sessionId, messages);
93// content is PII-filtered; audit is a hash-only record safe to persist
94```
95
96## Resources
97
98- [Groq Privacy Policy](https://groq.com/privacy-policy/)
99- [Groq Pricing](https://groq.com/pricing)
100- [Llama Guard (content moderation)](https://console.groq.com/docs/model/meta-llama/llama-guard-4-12b)
101- [Full implementation](references/implementation.md) · [Examples](references/examples.md)
102
103For enterprise access controls, see the `groq-enterprise-rbac` skill.
gabrielmoreira