Trust
What we hold, what we never see, and who else is involved.
This page is the plain-language version of the security questionnaire. It covers the product and this website separately, because they are separate systems with no connection between them.
The product
Data handling
- Masking happens on the node
- Fields named in a signed policy are masked by the agent before an event leaves the machine. The stream and lake never receive the original value, and neither do we.
- Data stays where you put it
- Managed: the stream and lake run in a region you choose and write to a bucket in your account. On your hardware: nothing leaves your network. There is no cross-region replication we do on your behalf.
- What we can see, managed
- Operational metrics of the stream and lake we run — throughput, errors, capacity — and the hierarchy names needed to run them. Not event contents.
- What we can see, on-prem
- Nothing, unless you opt in to product telemetry, which is written to a bucket you own and shared with us by your choice.
- Coverage as a control
- Because the agent reports what it refused, sampled or lost, an audit can show what was not collected as well as what was.
This website
Security posture
- No connection to the data plane
- The website is static files. It has no database, no session, no login and holds no telemetry. It cannot reach any customer's stream or lake.
- No secret in the browser
- The demo form posts to a small relay function. The CRM credential lives in that function's environment and is never in the page bundle.
- Third-party scripts
- One privacy-preserving analytics provider, named below once selected. No session recording, no advertising pixel, no cookie banner because there is nothing to consent to.
- Headers
- A Content-Security-Policy is set at the host. No page relies on inline script to render.
Subprocessors
Who else touches what
Listed here and updated when they change. If a name below says "to be named", it means the provider has not been selected yet and we would rather say so than guess.
- Website hosting
- Static host with per-preview URLs. To be named at launch.
- Demo form relay
- Serverless function forwarding to our CRM. Receives the fields you type and nothing else. Providers to be named at launch.
- Analytics
- One privacy-preserving provider. To be named at launch.
- Managed product
- Cloud provider for the stream and lake in the region you choose. Published with the managed service.
Reporting
Security disclosures
Write to hello@cosmotrace.io with "security" in the subject. We acknowledge within one business day and tell you what we found and what we changed.