What leaves your machines, and what does not.
Written for the person who has to sign off on this. Outcomes and guarantees, not a tour of our internals.
Redacted before it leaves the machine
Sensitive fields are stripped on your server, by the agent, before anything is transmitted. Not filtered on arrival, not redacted in a dashboard view. If a value is excluded, it never crossed your network boundary in the first place — so a breach of our infrastructure cannot expose what we were never sent.
- redaction happens
- on your machine
- applied
- before transmission
- configurable
- yes, per organisation
A network failure costs you nothing
Telemetry is written locally first and replayed, in order, once the link returns. Cutting the network during an incident is the moment you most need the data, and it is exactly when most agents drop it. Ours queues on disk and catches up.
- data lost in a partition
- none
- queued
- on your machine
- replay order
- preserved
Unknown agents get nothing
Every agent proves which organisation it belongs to before it is allowed to send or receive anything. An agent that cannot prove it is refused outright — there is no anonymous ingest path, and no way for one customer to read another’s telemetry.
- enrolment
- token-based
- anonymous ingest
- not possible
- tenant isolation
- enforced server-side
EU only, end to end
Storage, processing and probe infrastructure are hosted inside the EU. No third-party data processors sit in the path of your telemetry, which means no onward transfer to review and a shorter answer for your DPO than most vendors can give.
- hosting
- EU only
- third-party processors
- none in the telemetry path
- GDPR
- DPA available
Binaries verify themselves
Agent releases are cryptographically signed, and each agent verifies a signature before it will replace itself. A tampered or substituted binary is rejected by the fleet rather than trusted because it arrived over HTTPS.
- releases
- signed
- verified
- before self-update
- unsigned builds
- refused
The record outlives the account
The audit log deliberately keeps no foreign key to the user who created an entry. Deleting a person does not quietly rewrite the history of who did what — which is usually the property an auditor actually cares about.
- audit entries
- immutable
- survives account deletion
- yes
- retention
- per organisation
The path your data takes.
Five hops, one direction. Deliberately described at the level a security review needs — if your assessment needs more than this, we will walk your team through it directly under NDA rather than publish it here.
- 01
On your machines
A single agent binary reads from native operating-system interfaces, redacts, and streams outward. No inbound port is opened on your side.
- 02
In transit
One outbound, authenticated, encrypted connection per machine. Resilient to packet loss, and buffered locally when the link drops.
- 03
Our receiver
Authenticates the agent, verifies its organisation, and writes to per-tenant storage. Rejects anything it cannot attribute.
- 04
Storage
EU-hosted time-series storage with per-organisation retention. Recent data stays fine-grained; older data is rolled up rather than kept in full.
- 05
Your dashboard
Reads only your organisation’s data, over an authenticated session, with every privileged action written to the audit log.
Doing a security review?
We would rather demonstrate these properties than assert them. Ask and we will show you the agent running on a machine you control, with the network cut, and let you inspect exactly what was sent.
Talk to an engineer→