diff --git a/packages/backend-common/api-report.md b/packages/backend-common/api-report.md
index 2336a57ec3..d38d9a72be 100644
--- a/packages/backend-common/api-report.md
+++ b/packages/backend-common/api-report.md
@@ -472,6 +472,9 @@ export type ReadUrlResponse = {
   etag?: string;
 };
 
+// @public (undocumented)
+export type RedactionMap = Record<string, string>;
+
 // @public
 export function requestLoggingHandler(logger?: Logger_2): RequestHandler;
 
@@ -539,6 +542,9 @@ export type ServiceBuilder = {
   start(): Promise<Server>;
 };
 
+// @public (undocumented)
+export function setRedactionMap(newRedactionMap: RedactionMap): void;
+
 // @public (undocumented)
 export function setRootLogger(newLogger: winston.Logger): void;
 
diff --git a/packages/backend-common/src/logging/rootLogger.ts b/packages/backend-common/src/logging/rootLogger.ts
index edeb235d4d..aaf91ff232 100644
--- a/packages/backend-common/src/logging/rootLogger.ts
+++ b/packages/backend-common/src/logging/rootLogger.ts
@@ -18,7 +18,8 @@ import * as winston from 'winston';
 import { LoggerOptions } from 'winston';
 import { coloredFormat } from './formats';
 
-type RedactionMap = Record<string, string>;
+/** @public */
+export type RedactionMap = Record<string, string>;
 
 let rootLogger: winston.Logger;
 let redactionMap: RedactionMap;
@@ -42,7 +43,7 @@ export function setRedactionMap(newRedactionMap: RedactionMap) {
  * A winston formatting function that finds occurrences of filteredKeys
  * and replaces them with the corresponding identifier.
  */
-export function redactLogLine(info: winston.Logform.TransformableInfo) {
+function redactLogLine(info: winston.Logform.TransformableInfo) {
   // TODO(hhogg): The logger is created before the config is loaded,
   // because the logger is needed in the config loader. There is a risk of
   // a secret being logged out during the config loading stage 🤷‍♂️