Security
Built so your network never has to let us in.
The agent runs next to your data and only dials out. It sends one reading and one status per metric, plus a heartbeat about itself; credentials resolve on the host.
Data flow
One direction. One reading at a time.
Your systems
Queries run here, next to the data. Rows, log lines and full series stay put.
The agent, on your host
observer-agent
Secrets are env vars on this host. The console only knows their names.
One reading, outbound
A number, a status and a timestamp per metric, on each flip and each push. Nothing listens for Observer.
Observer Cloud
Stores readings, verdicts and your configuration. Never the value of a secret.
The reading path. Heartbeats use the same outbound connection; the cloud never connects in.
Boundary
What crosses, what stays.
Leaves your network
Readings and status
outboundA number, a status and a timestamp per metric, on each flip and each push interval.
{ metric_id, value, status, timestamp }Leaves your network
Agent heartbeat
outboundA heartbeat every 30 seconds: agent version and build, uptime, the host name, queue depth, the source types in use, and the names of custom probes you registered (not their descriptions). Log forwarding is off unless you turn it on. When you browse CloudWatch metrics in the console, the agent returns metric names and dimensions, no values.
Held by Observer
Your configuration
consoleQueries, thresholds and target URLs live in the console so the agent can fetch them. Secrets appear only as the name of an env var.
connection_string_ref: PG_DSNStays on your host
Credentials and raw results
never sentDatabase connection strings, client certificates and keys, Loki and Elasticsearch tokens, and AWS credentials. Rows, log lines and full series stay too: a query sends back only the number it extracted.
Controls
Each one is in the code.
Network
Outbound only
HTTPSThe agent dials out to Observer. Nothing in your network has to accept a connection from us.
Keys
Agent keys
SHA-25632 random bytes, shown once and stored only as a SHA-256 hash. Rotation keeps the old key valid for 24 hours, or revokes it at once.
Tenancy
Tenant isolation
org_idEvery query is scoped to your organisation in application code, not database row-level security. A cross-tenant test suite runs on every build.
Secrets
Integration secrets
AES-GCMWebhook URLs, routing keys and signing secrets are encrypted before they reach the database.
Webhooks
Signed webhooks
HMAC-SHA-256Every outbound webhook is signed over a timestamp and its body, so receivers can reject forgeries and replays.
Audit
Audit log
90 daysWho did what to which resource, from which IP, and when. Append-only: entries cannot be changed or deleted, and are kept for 90 days.
Evidence
Signed history
Ed25519Opt in and every status flip is signed, hash-chained and anchored to Bitcoin through OpenTimestamps. Anyone can verify the chain without trusting us.
Source
Open-source agent
Apache 2.0Read every line that runs in your network, or build it from source.
Logs
Agent logs
off by defaultDiagnostic logs stay on the host unless you set BROADCAST_LOGS. PromQL in them is reduced to a hash.
Data
How your data is kept.
In transit
TLS everywhere
Every connection to Observer, to public status pages and from the agent is encrypted with TLS.
Backups
Encrypted backups
30-day recoveryDaily full backups and a continuously archived write-ahead log, encrypted at rest. Recovery to any point in the last 30 days.
Recovery
Continuously replicated
A continuously replicated copy of the production database can take over if the primary fails.
Residency
EEA and United Kingdom
data at restCustomer data at rest, including backups, is held in the European Economic Area and the United Kingdom.
Subprocessors
Clerk, Stripe and Resend
Sign-in and billing through Clerk, payments through Stripe via Clerk, and transactional email through Resend.
Every subprocessor, with location and transfer mechanismKeep reading