cb0be106b · cryptotaxi247/netdata-1

@@ -1,18 +1,18 @@

1 # Security and privacy design

2

3 -This document serves as the relevant Annex to the [Terms of Service](http://netdata.cloud/service-terms/) and

3 +This document serves as the relevant Annex to the [Terms of Service](http://netdata.cloud/service-terms/), the [Privacy Policy](https://www.netdata.cloud/privacy/) and

4 the Data Processing Addendum, when applicable. It provides more information regarding Netdata’s technical and organizational security and privacy measures.

5

6 We have given special attention to all aspects of Netdata, ensuring that everything throughout its operation is as secure as possible. Netdata has been designed with security in mind.

7

8 > When running Netdata in environments requiring Payment Card Industry Data Security Standard (**PCI DSS**), Systems and Organization Controls (**SOC 2**),

9 or Health Insurance Portability and Accountability Act (**HIPAA**) compliance, please keep in mind that

10 -**even when you use Netdata Cloud, all collected data is always stored inside your infrastructure**.

10 +**even when the user uses Netdata Cloud, all collected data is always stored inside their infrastructure**.

11

12 -Dashboard data you view and alert notifications do travel

13 -over Netdata Cloud, as they also travel over third party networks, to reach your web browser or the notification integrations you have configured,

12 +Dashboard data a user views and alert notifications do travel

13 +over Netdata Cloud, as they also travel over third party networks, to reach the user's web browser or the notification integrations the user has configured,

14 but Netdata Cloud does not store metric data. It only transforms them as they pass through it, aggregating them from multiple Agents and Parents,

15 -to appear as one data source on your browser.

15 +to appear as one data source on the user's browser.

16

17 ## Cloud design

18

@@ -38,10 +38,10 @@ cookies, the IP is also stored in the systems we use to track the usage of the a

38

39 ### Infrastructure data stored

40

41 -The metric data that you see in the web browser when using Netdata Cloud is streamed directly from the Netdata Agent

41 +The metric data that a user sees in the web browser when using Netdata Cloud is streamed directly from the Netdata Agent

42 to the Netdata Cloud dashboard, via the Agent-Cloud link (see [data transfer](#data-transfer)). The data passes through our systems, but it isn’t stored.

43

44 -The metadata we do store for each node connected to your Spaces in Netdata Cloud is:

44 +The metadata we do store for each node connected to the user's Spaces in Netdata Cloud is:

45 - Hostname (as it appears in Netdata Cloud)

46 - Information shown in `/api/v1/info`. For example: [https://frankfurt.my-netdata.io/api/v1/info](https://frankfurt.my-netdata.io/api/v1/info).

47 - Metric metadata information shown in `/api/v1/contexts`. For example: [https://frankfurt.my-netdata.io/api/v1/contexts](https://frankfurt.my-netdata.io/api/v1/contexts).

@@ -55,14 +55,14 @@ The infrastructure data is stored in our production database on AWS and copied t

55

56 All infrastructure data visible on Netdata Cloud has to pass through the Agent-Cloud link (ACLK) mechanism, which

57 securely connects a Netdata Agent to Netdata Cloud. The Netdata agent initiates and establishes an outgoing secure

58 -WebSocket (WSS) connection to Netdata Cloud. The ACLK is encrypted, safe, and is only established if you connect your node.

58 +WebSocket (WSS) connection to Netdata Cloud. The ACLK is encrypted, safe, and is only established if the user connects their node.

59

60 Data is encrypted when in transit between a user and Netdata Cloud using TLS.

61

62 ### Data retention

63

64 -Netdata may maintain backups of Netdata Cloud Customer Content, which would remain in place for approximately thirty

65 -(30) days following a deletion in Netdata Cloud.

64 +Netdata may maintain backups of Netdata Cloud Customer Content, which would remain in place for approximately ninety

65 +(90) days following a deletion in Netdata Cloud.

66

67 ### Data portability and erasure

68

@@ -80,17 +80,17 @@ the Customer’s written request, within the timeframe specified in the DPA and

80

81 #### Delete all personal data

82

83 -To remove all personal info we have about you (email and activities) you need to delete your cloud account by logging into https://app.netdata.cloud and accessing your profile, at the bottom left of your screen.

83 +To remove all personal info we have about a user (email and activities) they need to delete their cloud account by logging into https://app.netdata.cloud and accessing their profile, at the bottom left of the screen.

84

85

86 ## Agent design

87

88 -### Your data is safe with Netdata

88 +### User data is safe with Netdata

89

90 Netdata collects raw data from many sources. For each source, Netdata uses a plugin that connects to the source (or reads the

91 relative files produced by the source), receives raw data and processes them to calculate the metrics shown on Netdata dashboards.

92

93 -Even if Netdata plugins connect to your database server, or read your application log file to collect raw data, the product of

93 +Even if Netdata plugins connect to the user's database server, or read user's application log file to collect raw data, the product of

94 this data collection process is always a number of **chart metadata and metric values** (summarized data for dashboard visualization).

95 All Netdata plugins (internal to the Netdata daemon, and external ones written in any computer language), convert raw data collected

96 into metrics, and only these metrics are stored in Netdata databases, sent to upstream Netdata servers, or archived to external

@@ -100,7 +100,7 @@ The **raw data** collected by Netdata does not leave the host when collected. **

100

101 This means that Netdata can safely be used in environments that require the highest level of data isolation (like PCI Level 1).

102

103 -### Your systems are safe with Netdata

103 +### User systems are safe with Netdata

104

105 We are very proud that **the Netdata daemon runs as a normal system user, without any special privileges**. This is quite an

106 achievement for a monitoring system that collects all kinds of system and application metrics.

@@ -124,7 +124,7 @@ the only feature that routes requests back to origin Netdata Agents via Netdata

124 a request to the Netdata Agent data collection plugin running at the

125 edge, to provide additional information, such as the process tree of a server, or the long queries of a DB.

126

127 -

127 +

128

129 ### Netdata is read-only

130

@@ -137,20 +137,20 @@ application versions, host IPs, etc. are not stored and are not exposed by Netda

137 ### Protect Netdata from the internet

138

139 Users are responsible to take all appropriate measures to secure their Netdata agent installations and especially the Netdata web user interface and API against unauthorized access. Netdata comes with a wide range of options to

140 -[secure your nodes](https://github.com/netdata/netdata/blob/master/docs/category-overview-pages/secure-nodes.md) in

141 -compliance with your organization's security policy.

140 +[secure user nodes](https://github.com/netdata/netdata/blob/master/docs/category-overview-pages/secure-nodes.md) in

141 +compliance with the user organization's security policy.

142

143 ### Anonymous statistics

144

145 #### Netdata registry

146

147 The default configuration uses a public [registry](https://github.com/netdata/netdata/blob/master/registry/README.md) under registry.my-netdata.io.

148 -If you use that public registry, you submit the following information to a third party server:

148 +If the user uses that public registry, they submit the following information to a third party server:

149 - The URL of the agent's web user interface (via http request referrer)

150 - - The hostnames of your Netdata servers

150 + - The hostnames of the user's Netdata servers

151

152 -If sending this information to the central Netdata registry violates your security policies, you can configure Netdata to

153 -[run your own registry](https://github.com/netdata/netdata/blob/master/registry/README.md#run-your-own-registry).

152 +If sending this information to the central Netdata registry violates user's security policies, they can configure Netdata to

153 +[run their own registry](https://github.com/netdata/netdata/blob/master/registry/README.md#run-your-own-registry).

154

155 #### Anonymous telemetry events

156

@@ -160,7 +160,7 @@ about the information collected and learn how to opt-out, on our

160

161 ### Netdata directories

162

163 -The agent stores data in 6 different directories on your system.

163 +The agent stores data in 6 different directories on the user's system.

164 <details>

165 <summary>Expand to see each directory's purpose, ownership and permissions</summary>

review usage of you to say user instead (#14858)