Security

Last updated · Edition 1

Tenant isolation

  • Tenant identity comes only from the credentials of the request. Telemetry cannot claim another tenant: incoming wt.* attributes are removed at the gateway before the tenant is stamped.

  • A resource the caller cannot access answers 404, as if it did not exist.

  • Every project is pinned to one data plane at creation and its data stays there.

Secrets and credentials

  • API keys, tokens and session tokens are shown once and stored only as SHA-256 hashes. They are never written to logs or audit events.

  • Notification receiver secrets, an organization's own SMTP settings and contact addresses (email, phone) are stored encrypted with AES-GCM under keys derived from the instance secret, each bound to its owner.

  • The operator's mail server must offer TLS (STARTTLS or implicit TLS); plain SMTP is accepted only for a receiver that an organization administrator has explicitly allowed it for.

Encryption in transit and at rest

  • In transit: the data processing agreement commits to encrypting data in transit, and outbound email requires TLS as above.

  • At rest: the secrets listed above are encrypted by the application. Archive objects are encrypted with a per-project key, and deleting that key (crypto-shredding) leaves every copy of the objects, including copies in backups, unreadable. This page makes no claim about disk-level encryption of the servers.

Data location and retention

  • Customer telemetry is stored on Watchtower's own servers at OVH (see subprocessors).

  • Retention is set per project; the defaults are logs 30 days and metrics 90 days. Deletion requests (with second-administrator approval by default) and legal holds are supported, as described in the privacy policy.

Backups

The Helm chart includes a scheduled backup job (backup, verify and prune), off unless an operator enables it. This page does not state a backup schedule or retention for the hosted service.

Incidents

Watchtower tells the customer without undue delay after learning of a personal-data breach, per the data processing agreement.

Certifications

This page claims no third-party certification or audit report.

All documents