How we handle your data
Putting a monitoring appliance on someone's network is a request for trust. This page is the specifics behind that request — what the node can reach, what leaves it, and what happens to the data on the way out. Written to hold up in a HIPAA, PCI-DSS, or SOC 2 review.
Sensitive data is stripped before it is stored
Log and packet data passes through a sanitisation step before it reaches any permanent index. That step
runs on an air-gapped deployment of Microsoft Presidio — the presidio-analyzer
and presidio-anonymizer services — with no route to the internet.
It redacts social security numbers, card numbers, medical account identifiers, and other personally identifiable fields at the point of ingest. The practical effect is that the useful signal is retained and the regulated content never lands in the index in the first place, so there is nothing to purge later.
Analysis models never leave your environment
Alert sorting, metric parsing, and incident summaries run on local Ollama engines inside your boundary. No hosted model API sees your traffic, which means there is no retention policy to read and no question about whether your network behaviour ends up in someone's training set.
Nothing needs to be opened for us
The node dials out and never listens. It needs zero inbound firewall rules — your perimeter policy stays exactly as it is, which is usually the difference between a deployment that gets approved and one that stalls in security review for a quarter.
The whitepaper goes a level deeper on transport, container isolation, and drift auditing — written for the person who has to sign off rather than the person who has to be sold.
Read the security whitepaper