No ad analytics. Keys stay server-side.
This page describes the data handled by a self-hosted deployment. The operator of this instance is responsible for its retention settings, AI-provider configuration, and any legal notices required in their jurisdiction.
None
The app does not ship an analytics SDK, advertising pixel, or third-party tracking script. Account and operational data are not sold.
Backend only
Integration and AI credentials are read on the backend and are never returned to the browser bundle. Queued email tokens are encrypted at rest with the operator-managed job key.
Local by default
Account details, saved investigations, evidence, and audit events are stored in the deployment database. Raw log-analysis pastes are not persisted by the analysis endpoint. Audit retention is configurable.
Authentication uses an HttpOnly session cookie and a readable CSRF cookie. OAuth, when enabled, uses a short-lived state cookie. External AI providers are contacted only when configured; redacted evidence summaries and the operator's question are sent, and AI privacy mode blocks that transmission. Accounts can be deleted from settings. Audit retention and database backups are controlled by the deployment operator. Optional error/trace exporters are configured by the operator and carry operational metadata, not advertising identifiers.