On this page
OverviewData flowHosting & infrastructureEncryptionTenant isolation & accessAuthentication & tokensRetention, deletion, exportRedaction & sensitive dataBackups & recoveryMonitoring & abuseEmployee accessSecure developmentVulnerability disclosureCompliance statusSecurity
How Errorgap stores, isolates, and protects the production telemetry you send us. Every claim below carries a status label so nothing reads as an unverified promise.
01Overview
Errorgap ingests error events, logs, traces, uptime checks, and deploy metadata, correlates them into incidents, and exposes them to your team and — when you enable it — to AI agents over MCP. This page describes the controls that protect that data in transit, at rest, and in use.
02Data flow
Telemetry travels from your SDK or agent to our ingest endpoint, through redaction, into per-tenant storage. Nothing is shared with a hosted LLM unless you explicitly trigger an AI summary.
| Stage | What happens | Status |
|---|---|---|
| Ingest | TLS 1.2+ to regional ingest; project key authenticates the source. | Live |
| Redaction | Org + project regex rules applied before any value is written to storage.Configurable per project | Configurable |
| Storage | Written to the tenant's logical partition, encrypted at rest. | Live |
| AI summary | Incident text sent to the configured model only on explicit "Summarize" — runs on Errorgap-managed infrastructure by default.Off by default; never automatic | On demand |
03Hosting & infrastructure
Errorgap runs on a single primary cloud region with managed, access-controlled infrastructure.
| Control | Detail | Status |
|---|---|---|
| Primary region | AWS US East (Ohio) · us-east-2. EU region for data residency is planned. | EU region |
| Provider | Amazon Web Services (AWS), with its own SOC 2 / ISO 27001 attestations. | Live |
| Network | Private subnets; no direct public database access; WAF at the edge. | Live |
04Encryption
Data is encrypted both in transit and at rest with industry-standard ciphers and managed keys.
| Layer | Method | Status |
|---|---|---|
| In transit | TLS 1.2+ on all ingest and dashboard endpoints; HSTS enforced. | Live |
| At rest | AES-256 on volumes and backups via the provider KMS. | Live |
| Key management | Managed keys, automatic rotation; customer-managed keys under evaluation. | CMK |
| Secrets | Application secrets held in a managed secrets store, never in source. | Live |
05Tenant isolation & access control
Every record is scoped to an organization. Application-layer authorization checks the acting principal's org, team, and project membership on every request.
- Logical isolation — all queries are tenant-scoped; cross-tenant reads are structurally prevented at the data-access layer.
- Role-based access — org, team, and project roles gate every action; least-privilege defaults for new members.
- Project-scoped agents — MCP tokens are bound to a team/project scope and a capability set, never to a human session.
| Boundary | Enforcement | Status |
|---|---|---|
| Org → org | No shared storage path; tenant ID required on every row. | Live |
| Member → project | Team & project membership checked server-side per request. | Live |
| SSO / SAML | SAML 2.0 single sign-on with JIT provisioning; enforced-domain SSO planned. | Available |
06Authentication & tokens
Humans authenticate with email + password or SSO; agents authenticate with scoped bearer tokens issued from the Agent Access page.
| Mechanism | Detail | Status |
|---|---|---|
| Password | Hashed with a modern memory-hard KDF; breach-list checks on set. | Live |
| MFA (TOTP) | Per-user TOTP; org admins can require it for all members. | Configurable |
| SSO / SAML | SAML 2.0 SSO with JIT and SCIM 2.0 provisioning, configured per org. | Configurable |
| Agent tokens | Scoped to team/project + capabilities; last-used IP & endpoint recorded; revocable. | Live |
| Session policy | Configurable idle + absolute session lifetime. | Configurable |
07Retention, deletion & export
You control how long telemetry is kept. Deletion and export are self-service from org settings; deletions cascade across primary storage and backups within the stated windows.
| Data | Default retention | Control |
|---|---|---|
| Errors & stack frames | 90 days by default.Configurable per deployment | Configurable |
| Logs & APM | 30 days by default. | Configurable |
| Infrastructure & uptime | 90 days by default; resolved incidents only. | Configurable |
| Error groups & incidents | Kept for the life of the project; the latest event per group is always retained. | Retained |
| Session replay | 30 days by default; configurable or disabled per project.Per-project setting | Opt-in |
| Deletion requests | Self-service deletion runs on a 30-day grace period, then purges. | Self-service |
| Export | Org-scoped JSON export; download link expires in 72h. | Self-service |
08Redaction & sensitive-data controls
Regex redaction rules run at the org and project level before any value is persisted or surfaced — in the UI, in MCP tool results, or in generated issue bodies.
- Applied before storage — matched values never reach disk in raw form.
- Org defaults + project rules — org rules are mandatory; projects may only add stricter rules.
- Live preview — every rule is tested against a sample value before it is saved.
09Backups & recovery
Encrypted backups are taken on a regular schedule and tested by restore. Recovery objectives are stated below.
| Control | Detail | Status |
|---|---|---|
| Database backups | Provided by the managed database platform with encryption at rest.Backup cadence and retention follow the hosting provider | Provider-managed |
| Deletion vs backups | Data removed from primary storage may persist in encrypted backups until the provider's backup retention window elapses.Documented caveat | Caveat |
| Restore testing & DR | Formal restore drills and documented RPO/RTO targets are planned. | Planned |
10Monitoring, rate limiting & abuse
Ingest is rate-limited per project key. Platform telemetry and alerting watch for anomalous traffic and authentication failures.
- Per-key ingest rate limits with burst handling and back-pressure.
- Authentication-failure and token-misuse alerting.
- Edge WAF and bot mitigation on public endpoints.
11Employee access
Access to production data is least-privilege, logged, and reviewed.
| Control | Detail | Status |
|---|---|---|
| Access basis | Need-to-know; production access requires MFA and is time-bound. | Live |
| Audit | Administrative actions on tenant data are logged. | Live |
| Offboarding | Access revoked on the same business day as departure. | Live |
12Secure development
Changes are peer-reviewed, dependency-scanned, and shipped through automated pipelines.
- Mandatory code review on every change to the main branch.
- Automated dependency and container vulnerability scanning in CI.
- Secrets scanning blocks credential commits before merge.
13Vulnerability disclosure
We welcome good-faith security research.
14Compliance status
We state compliance posture honestly. The badges below reflect today's reality, not aspiration — nothing is marked available until it is certified.
| Framework | Status | Notes |
|---|---|---|
| SOC 2 Type II | In progress | Observation period underway; report expected this year. |
| ISO 27001 | Planned | Scoping; no certificate yet. |
| GDPR | Supported | DPA available; EU data residency planned. See Privacy Policy. |
| HIPAA | Not offered | No BAA; PHI is out of scope by design. |
| PCI DSS | Not offered | Billing handled by a PCI-compliant processor; we never store card data. |