df4277f11 · cryptotaxi247/netdata-1

@@ -1,9 +1,8 @@

1 # Security and Privacy Design

2

3 This document serves as the relevant Annex to the [Terms of Service](https://www.netdata.cloud/service-terms/),

4 -the [Privacy Policy](https://www.netdata.cloud/privacy/) and

5 -the Data Processing Addendum, when applicable. It provides more information regarding Netdata’s technical and

6 -organizational security and privacy measures.

4 +the [Privacy Policy](https://www.netdata.cloud/privacy/) and the Data Processing Addendum, when applicable.

5 +It provides more information regarding Netdata’s technical and organizational security and privacy measures.

6

7 We have given special attention to all aspects of Netdata, ensuring that everything throughout its operation is as

8 secure as possible. Netdata has been designed with security in mind.

@@ -16,6 +15,13 @@ Netdata, an open-source software widely installed across the globe, prioritizes

15 commitment to safeguarding user data. The entire structure and internal architecture of the software is built to ensure

16 maximum security. We aim to provide a secure environment from the ground up, rather than as an afterthought.

17

18 +Netdata Cloud ensures a secure, user-centric environment for monitoring and troubleshooting, treating

19 +observability data and observability metadata distinctly to maintain user control over system insights and

20 +personal information. **Observability data**, which includes metric values (time series) and log events, remains

21 +fully under user control, stored locally on the user's premises. **Observability metadata**, including hostnames,

22 +metric names, alert names, and alert transitions, is minimally required by Netdata Cloud and securely managed

23 +for routing and platform usage purposes.

24 +

25 ### Compliance with Open Source Security Foundation Best Practices

26

27 Netdata is committed to adhering to the best practices laid out by the Open Source Security Foundation (OSSF).

@@ -23,7 +29,7 @@ Currently, the Netdata Agent follows the OSSF best practices at the passing leve

29 the [OSSF guidelines](https://bestpractices.coreinfrastructure.org/en/projects/2231)

30

31 Netdata Cloud boasts of comprehensive end-to-end automated testing, encompassing the UI, back-end, and agents, where

26 -involved. In addition, the Netdata Agent uses an array of third-party services for static code analysis, static code

32 +involved. In addition, the Netdata Agent uses an array of third-party services for static code analysis,

33 security analysis, and CI/CD integrations to ensure code quality on a per pull request basis. Tools like Github's

34 CodeQL, Github's Dependabot, our own unit tests, various types of linters,

35 and [Coverity](https://scan.coverity.com/projects/netdata-netdata?tab=overview) are utilized to this end.

@@ -75,14 +81,14 @@ protection laws, including the GDPR and CCPA.

81

82 ### Data Transfers

83

78 -While Netdata Agent itself does not engage in any cross-border data transfers, certain infrastructure metadata

79 -is transferred to Netdata Cloud for the purpose of providing its services. All observability data collected and

80 -processed by Netdata Agents, however, stays strictly within the user's infrastructure, eliminating any concerns about

81 -cross-border data transfer issues.

84 +While Netdata Agent itself does not engage in any cross-border data transfers, certain **observability metadata** (e.g.

85 +hostnames, metric names, alert names, and alert transitions) is transferred to Netdata Cloud solely to provide routing

86 +and alert notifications. **Observability data**, consisting of metric values (time series) and log events, stays

87 +strictly within the user's infrastructure, mitigating cross-border data transfer concerns.

88

83 -When users utilize Netdata Cloud, the parts of the observability data which are viewed via Netdata Cloud, are streamed

84 -from the Netdata Agents to the users’ web browsers via Netdata Cloud, without being stored on Netdata Cloud's servers.

85 -This is optional and users have the ability to use observability dashboards bypassing Netdata Cloud.

89 +For users leveraging Netdata Cloud, **observability data** is securely tunneled through Netdata Cloud for real-time

90 +viewing, similar to a VPN, without being stored on Netdata Cloud servers. This approach ensures that Netdata Cloud

91 +maintains only necessary metadata, while full control of observability data remains with the user.

92

93 Netdata Cloud only stores Netdata Cloud users identification data (such as observability users' email addresses) and

94 infrastructure metadata (such as infrastructure hostnames) necessary for Netdata Cloud's operation. All these metadata

@@ -108,9 +114,11 @@ and reach out with any questions or concerns they may have about data protection

114

115 ## Anonymous Statistics

116

111 -The anonymous statistics collected by the Netdata Agent are related to the installations and not to individual users.

112 -This data includes community size, types of plugins used, possible crashes, operating systems installed, and the use of

113 -the registry feature. No IP addresses are collected, but each Netdata installation has a unique ID.

117 +The anonymous statistics collected by the Netdata Agent pertain to installations rather than individual users,

118 +capturing general information such as community size, plugin types, crashes, operating systems, and feature usage.

119 +Importantly, **observability data** — metric values and log events — remain local to the user's infrastructure and

120 +are not collected in this process. **Observability metadata**, including unique IDs for installations, is anonymized

121 +and stored solely to support product development and community understanding.

122

123 Netdata also collects anonymous telemetry events, which provide information on the usage of various features, errors,

124 and performance metrics. This data is used to understand how the software is being used and to identify areas for

@@ -134,41 +142,45 @@ improvement, while respecting user privacy and maintaining transparency.

142 Internal Security Measures at Netdata are designed with an emphasis on data privacy and protection. The measures

143 include:

144

137 -1. **Infrastructure as Code (IaC)** :

145 +1. **Observability data and metadata distinction**

146 + Netdata Cloud securely handles observability metadata in isolated environments, while observability data remains

147 + exclusively within user premises, stored locally and managed by the user. This distinction ensures that only

148 + minimal metadata is required for routing and system identification.

149 +3. **Infrastructure as Code (IaC)** :

150 Netdata Cloud follows the IaC model, which means it is a microservices environment that is completely isolated. All

151 changes are managed through Terraform, an open-source IaC software tool that provides a consistent CLI workflow for

152 managing cloud services.

141 -2. **TLS Termination and IAM Service** :

153 +4. **TLS Termination and IAM Service** :

154 At the edge of Netdata Cloud, there is a TLS termination, which provides the decryption point for incoming TLS

155 connections. Additionally, an Identity Access Management (IAM) service validates JWT tokens included in request

156 cookies or denies access to them.

145 -3. **Session Identification** :

157 +5. **Session Identification** :

158 Once inside the microservices environment, all requests are associated with session IDs that identify the user making

159 the request. This approach provides additional layers of security and traceability.

148 -4. **Data Storage** :

160 +6. **Data Storage** :

161 Data is stored in various NoSQL and SQL databases and message brokers. The entire environment is fully isolated,

162 providing a secure space for data management.

151 -5. **Authentication** :

163 +7. **Authentication** :

164 Netdata Cloud does not store credentials. It offers three types of authentication: GitHub Single Sign-On (SSO),

165 Google SSO, and email validation.

154 -6. **DDoS Protection** :

166 +8. **DDoS Protection** :

167 Netdata Cloud has multiple protection mechanisms against Distributed Denial of Service (DDoS) attacks, including

168 rate-limiting and automated blacklisting.

157 -7. **Security-Focused Development Process** :

169 +9. **Security-Focused Development Process** :

170 To ensure a secure environment, Netdata employs a security-focused development process. This includes the use of

171 static code analyzers to identify potential security vulnerabilities in the codebase.

160 -8. **High Security Standards** :

172 +10. **High Security Standards** :

173 Netdata Cloud maintains high security standards and can provide additional customization on a per contract basis.

162 -9. **Employee Security Practices** :

174 +11. **Employee Security Practices** :

175 Netdata ensures its employees follow security best practices, including role-based access, periodic access review,

176 and multi-factor authentication. This helps to minimize the risk of unauthorized access to sensitive data.

165 -10. **Experienced Developers** :

177 +12. **Experienced Developers** :

178 Netdata hires senior developers with vast experience in security-related matters. It enforces two code reviews for

179 every Pull Request (PR), ensuring that any potential issues are identified and addressed promptly.

168 -11. **DevOps Methodologies** :

180 +13. **DevOps Methodologies** :

181 Netdata's DevOps methodologies use the highest standards in access control in all places, utilizing the best

182 practices available.

171 -12. **Risk-Based Security Program** :

183 +14. **Risk-Based Security Program** :

184 Netdata has a risk-based security program that continually assesses and mitigates risks associated with data

185 security. This program helps maintain a secure environment for user data.

186

@@ -247,7 +259,12 @@ Netdata is committed to continuous improvement in security and privacy. While we

259

260 ## Conclusion

261

250 -In conclusion, Netdata Cloud's commitment to data security and user privacy is paramount. From the careful design of the

262 +Netdata Cloud is designed to secure observability insights for users, maintaining a clear separation between

263 +observability data and observability metadata. All observability data — metric values and log events — are stored locally,

264 +entirely under user control, while only essential metadata (hostnames, metric names, alert details) is managed by Netdata

265 +Cloud for system routing and alerting.

266 +

267 +Netdata Cloud's commitment to data security and user privacy is paramount. From the careful design of the

268 infrastructure and stringent internal security measures to compliance with international regulations and standards like

269 GDPR and CCPA, Netdata Cloud ensures a secure environment for users to monitor and troubleshoot their systems.

270

Update README.md