How we handle your data

Credentials are redacted before anything leaves

Logs carry secrets more often than anyone intends — passwords in command lines, tokens in connection strings, bearer headers. The collector on the node redacts credential-shaped values before an event leaves your site, so they are never sent, let alone stored.

That is pattern-based redaction of credentials, not classification of regulated data. If your logs carry patient or cardholder data, tell us before deployment: what the node collects can be narrowed, and that is a scoping conversation rather than a setting.

The node watches; it cannot act

Intrusion detection reads a mirror port rather than sitting inline, so it cannot drop or alter your traffic. Nothing on the appliance has write access to your infrastructure — no firewall bouncer, no automated response, no configuration push.

Your telemetry is kept apart from every other client's by the tunnel it arrives on: the platform identifies a client by the node's tunnel address, which the node cannot change, and accepts nothing from an address it does not know.

Encrypted in transit, bounded at rest

Everything the node sends travels inside its WireGuard tunnel. It is stored in Cloudflare R2, encrypted at rest, for a period set by your agreement — by default 31 days of logs and 90 of metrics — and then deleted by the storage engine itself rather than by a cleanup job someone has to remember to run.

Nothing needs to be opened for us

The node dials out and accepts nothing from the internet. It needs zero inbound firewall rules — your perimeter policy stays exactly as it is, which is usually the difference between a deployment that gets approved and one that stalls in security review for a quarter. From your own network it accepts only what your devices send it: syslog, SNMP traps and, if you run them, Wazuh agents.