SecurityArchitecture
Your secrets never leave your network.
The Observer agent runs next to your data, resolves credentials from environment variables on your host, and only dials out. Per metric it sends one reading and one status, plus a heartbeat about the agent itself. Raw rows, log lines and full series stay where they are.
Data flow
One direction. One reading at a time.
Your systems
Queries run here, next to the data. Rows, log lines and full series stay put.
The agent, on your host
observer-agent
Secrets are env vars on this host. The console only knows their names.
One reading, outbound
A number, a status and a timestamp per metric, on each flip and each push. Nothing listens for Observer.
Observer Cloud
Stores readings, verdicts and your configuration. Never the value of a secret.
The reading path. Heartbeats use the same outbound connection; the cloud never connects in.
Boundary
What crosses, and what never does.
Leaves your network
One reading and one status per metric
outboundOn each status flip and each push interval: the number your query returned, the status the agent computed against your thresholds, a timestamp, and a reason code when there was no data.
{ metric_id, value, status, timestamp, reason? }Leaves your network
A heartbeat
outboundAgent version and build, uptime, the host name, queue depth and age, the source types in use, and the names of any custom probes you registered (not their descriptions). Every 30 seconds. No readings, queries or secrets.
Held by Observer
Your configuration
consoleThe metric definitions, queries, thresholds and probe targets you create in the console, which the agent fetches. Where a probe needs a secret, the console stores only the name of an environment variable.
connection_string_ref: PG_DSNStays on your host
Secrets
never sentDatabase connection strings, client certificates and keys, Loki and Elasticsearch tokens and passwords, and secret HTTP, WebSocket and gRPC headers are configured as environment variable names and read on the host. Prometheus credentials are agent settings. CloudWatch uses the host's own AWS credentials.
Stays on your host
Raw results
never sentRows, log lines and full series. A database query must return one row and one column, and a Loki query must be an aggregation, so the agent extracts a single number before anything leaves.
Connections
Every request the agent makes.
The agent needs outbound HTTPS on port 443 to one host, Observer Cloud. Nothing in your network has to accept a connection from us. These are all the calls it makes, and when.
Always
Fetch configuration
GETReads the metric definitions assigned to this agent: queries, thresholds, targets and env var names.
/api/agent/metrics-definitionsAlways
Send readings
POSTBatches of readings and verdicts. If Observer is unreachable they wait in a local queue on your disk (10,000 rows by default, oldest dropped beyond that) and drain in order.
/api/agent/receiver/batchAlways
Heartbeat
POSTAgent health, as listed above. The response tells the agent when its configuration changed.
/api/agent/heartbeatOnly if you turn it on
Log forwarding
opt-inOff by default. With BROADCAST_LOGS=true, log lines at or above the level you choose are sent. PromQL in agent logs is reduced to a hash either way.
/api/agent/logOnly with CloudWatch
Metric catalogue
on requestWhen you browse CloudWatch metrics in the console, the agent lists them with your host's AWS credentials and returns metric names and dimensions. No values.
/api/agent/work/cloudwatch-list-metricsOnly if you turn it on
Heartbeat relay
opt-inFor jobs without internet access. Off by default. When on, it forwards only what a job sends it: the ping, its exit code and up to 10 KB of body.
/api/agent/heartbeat-relayOn your host
What runs inside your network.
Transport
TLS verified, no redirects
HTTPSCertificate verification is on unless you explicitly turn it off. The agent never follows a redirect, so its key is never re-sent to another host.
Queries
Read-only database probes
SELECT onlyThe agent checks that a database query is read-only before it runs it. A read-only database role is still the right setup.
Verdicts
Computed on the agent
strictThe agent compares each reading with your thresholds. Over means greater than, under means less than: a value equal to the threshold does not match.
Listeners
Loopback by default
127.0.0.1The debug dashboard and the OpenTelemetry receiver listen on loopback only, and refuse any other address until you set a bearer token. The heartbeat relay is off unless you enable it.
Identity
Agent keys
SHA-25632 random bytes, shown once, stored by Observer only as a hash. Rotate with a 24-hour grace period or revoke at once.
Source
Open source
Apache 2.0Every line that runs in your network is public. Read it, audit it, or build the agent yourself.
Verify
Check it without trusting us.
Source
Read the source
The agent repository is public. The request paths above are the only calls to Observer Cloud in it.
Network
Watch the egress
Allow 443/tcp to the Observer Cloud host and nothing else. The agent works, because it needs nothing else.
Console
Look at what the console holds
Open any probe in the console or export your configuration: where a secret is needed you will find an env var name, never a value.
Agent
Inspect the agent
The local debug dashboard shows the agent's state, recent logs and its settings, with every value masked.
Observer Cloud
On our side.
Data
Held in the EEA and the UK
updated 2026-10-15In Observer Cloud, customer data at rest is held in the European Economic Area and the United Kingdom, every connection uses TLS, and backups are encrypted. Observer holds no third-party certifications. The security policy and the subprocessor list have the details.