| 1 | # Security and Privacy Design |
| 2 | |
| 3 | :::tip |
| 4 | |
| 5 | **Executive Summary** |
| 6 | |
| 7 | - Netdata is built with security-first principles to protect user data across all systems. |
| 8 | - Observability data remains local, while minimal metadata travels securely to Netdata Cloud. |
| 9 | - We follow best practices to support GDPR, CCPA, PCI DSS, SOC 2, and HIPAA compliance. |
| 10 | |
| 11 | ::: |
| 12 | |
| 13 | ## Introduction |
| 14 | |
| 15 | This page explains how Netdata designs and operates secure, privacy-respecting services across the Netdata Agent and Netdata Cloud. |
| 16 | |
| 17 | Netdata builds security into every layer. You retain control over your observability data while benefiting from powerful real-time monitoring and insights. |
| 18 | |
| 19 | ## Netdata's Security Principles |
| 20 | |
| 21 | ### Security by Design |
| 22 | |
| 23 | Netdata separates your system information into two categories: |
| 24 | |
| 25 | | **Type** | **Description** | **Where It Lives** | |
| 26 | |:-----------------------|:--------------------------------|:------------------------------------------------------------------| |
| 27 | | Observability Data | Metrics and logs | Stored locally, fully under your control | |
| 28 | | Observability Metadata | Hostnames, metric names, alerts | Routed securely to Netdata Cloud for dashboards and notifications | |
| 29 | |
| 30 | This ensures that your critical system insights remain private, and only minimal metadata flows to the cloud. |
| 31 | |
| 32 | ### Observability Data and Metadata Flow |
| 33 | |
| 34 | Here is how your data flows through Netdata: |
| 35 | |
| 36 | ```mermaid |
| 37 | flowchart TD |
| 38 | A("Your System") -->|"Collect metrics and logs"| B("Netdata Agent") |
| 39 | B --> C("Observability Data<br/>Stored locally") |
| 40 | B --> D("Observability Metadata<br/>securely routed to Cloud") |
| 41 | D --> E("Cloud dashboards, routing<br/>& notifications") |
| 42 | |
| 43 | %% Style definitions |
| 44 | classDef alert fill:#ffeb3b,stroke:#000000,stroke-width:3px,color:#000000,font-size:14px |
| 45 | classDef neutral fill:#f9f9f9,stroke:#000000,stroke-width:3px,color:#000000,font-size:14px |
| 46 | classDef complete fill:#4caf50,stroke:#000000,stroke-width:3px,color:#000000,font-size:14px |
| 47 | classDef database fill:#2196F3,stroke:#000000,stroke-width:3px,color:#000000,font-size:14px |
| 48 | |
| 49 | %% Apply styles |
| 50 | class A alert |
| 51 | class B neutral |
| 52 | class C complete |
| 53 | class D,E database |
| 54 | ``` |
| 55 | |
| 56 | :::tip |
| 57 | |
| 58 | Observability data (metrics and logs) never leaves your system. Only essential metadata flows securely to Netdata Cloud. |
| 59 | |
| 60 | ::: |
| 61 | |
| 62 | ### Compliance with Open Source Security Foundation (OSSF) Best Practices |
| 63 | |
| 64 | Netdata follows [OSSF best practices](https://bestpractices.coreinfrastructure.org/en/projects/2231), including: |
| 65 | |
| 66 | - Automated testing across the UI, backend, and Agent |
| 67 | - Static and security code analysis with GitHub CodeQL, Dependabot, linters, and [Coverity](https://scan.coverity.com/projects/netdata-netdata?tab=overview) |
| 68 | - Two senior engineer reviews per pull request |
| 69 | - Continuous stress testing in production-like environments |
| 70 | |
| 71 | ### Third-Party Testing and Isolation |
| 72 | |
| 73 | Netdata Agents undergo regular external security audits. |
| 74 | All reports are prioritized for quick investigation and resolution. |
| 75 | |
| 76 | Netdata Cloud operates in isolated environments with Infrastructure as Code (IaC). No manual production access exists, and monitoring is fully automated. |
| 77 | |
| 78 | ### Security Vulnerability Response |
| 79 | |
| 80 | Netdata handles vulnerabilities with a clear process: |
| 81 | |
| 82 | - Full investigation of reported issues |
| 83 | - Mitigation typically within one week |
| 84 | - Immediate patch releases when necessary |
| 85 | |
| 86 | :::tip |
| 87 | |
| 88 | Stay updated by subscribing to [Netdata’s GitHub releases](https://github.com/netdata/netdata/security/policy). |
| 89 | |
| 90 | ::: |
| 91 | |
| 92 | ## Compliance with Regulations |
| 93 | |
| 94 | Netdata complies with major data privacy laws, including GDPR and CCPA. |
| 95 | |
| 96 | ### GDPR and CCPA Compliance |
| 97 | |
| 98 | Netdata conducts internal audits to ensure compliance and offers Data Processing Agreements (DPAs) upon request. |
| 99 | |
| 100 | :::tip |
| 101 | |
| 102 | Contact Netdata Support to request a DPA. |
| 103 | |
| 104 | ::: |
| 105 | |
| 106 | ### Data Transfers |
| 107 | |
| 108 | | **Type** | **Handling** | |
| 109 | |:-----------------------|:-----------------------------------------------------------------------------| |
| 110 | | Observability Data | Remains on your infrastructure | |
| 111 | | Observability Metadata | Securely transferred and stored in US-based data centers (Google Cloud, AWS) | |
| 112 | |
| 113 | Data is tunneled securely in real-time without being stored on Netdata Cloud servers. |
| 114 | |
| 115 | Data processing complies with GDPR and CCPA requirements. |
| 116 | |
| 117 | ### Privacy Rights |
| 118 | |
| 119 | You can manage your privacy rights easily: |
| 120 | |
| 121 | | **Right** | **How to Access** | |
| 122 | |:---------------------------------------|:-------------------------------------------------------------------------------------------------| |
| 123 | | Access, correct, or delete your data | Use the Netdata Cloud UI | |
| 124 | | Fully delete your account and all data | Log in to [app.netdata.cloud](https://app.netdata.cloud), go to Profile, and delete your account | |
| 125 | |
| 126 | :::tip |
| 127 | |
| 128 | Deleting your account removes all associated personal data, including email and activity records. |
| 129 | |
| 130 | ::: |
| 131 | |
| 132 | ### Regular Reviews and Updates |
| 133 | |
| 134 | Netdata continuously updates its policies and technical controls to stay aligned with evolving regulations. |
| 135 | |
| 136 | ## Anonymous Statistics |
| 137 | |
| 138 | Netdata collects anonymous installation and telemetry statistics to improve its services. |
| 139 | |
| 140 | | **Collected** | **Used For** | |
| 141 | |:--------------------------------------------------------------|:------------------------------------------------------| |
| 142 | | Installation info (plugins, operating systems, feature usage) | Guide product development and prioritize improvements | |
| 143 | | Telemetry events (errors, performance metrics) | Identify issues and enhance stability | |
| 144 | |
| 145 | - Observability data (metrics and logs) is never collected. |
| 146 | - Metadata is anonymized before storage. |
| 147 | |
| 148 | ### Opting Out |
| 149 | |
| 150 | You can disable anonymous telemetry: |
| 151 | |
| 152 | - During installation |
| 153 | - Anytime after, by removing the telemetry opt-in file |
| 154 | |
| 155 | :::tip |
| 156 | |
| 157 | See [installation documentation](https://learn.netdata.cloud/docs/netdata-agent/anonymous-telemetry-events#opt-out) for detailed opt-out steps. |
| 158 | |
| 159 | ::: |
| 160 | |
| 161 | Netdata does not sell or share anonymous statistics with any third parties. |
| 162 | |
| 163 | ## Internal Security Measures |
| 164 | |
| 165 | Netdata enforces layered security controls: |
| 166 | |
| 167 | | **Area** | **Control** | |
| 168 | |:--------------------------|:------------------------------------------------| |
| 169 | | Infrastructure Management | Infrastructure as Code (Terraform) | |
| 170 | | Authentication | GitHub SSO, Google SSO, email validation | |
| 171 | | Data Handling | TLS encryption, session tracking | |
| 172 | | Access Control | Role-based access, multi-factor authentication | |
| 173 | | Threat Defense | DDoS protection, vulnerability scanning | |
| 174 | | Developer Process | Static analyzers, mandatory senior code reviews | |
| 175 | | Production Isolation | No direct access to production environments | |
| 176 | |
| 177 | :::tip |
| 178 | |
| 179 | Need additional security configurations? Contact Netdata Support. |
| 180 | |
| 181 | ::: |
| 182 | |
| 183 | ## Standards Alignment |
| 184 | |
| 185 | :::tip |
| 186 | |
| 187 | View Netdata's security certifications, compliance reports, and audit documentation at our [Trust Center](https://trust.netdata.cloud/). |
| 188 | |
| 189 | ::: |
| 190 | |
| 191 | ### PCI DSS Alignment |
| 192 | |
| 193 | Netdata applies practices that align with PCI DSS security principles: |
| 194 | |
| 195 | - Secure infrastructure |
| 196 | - Access control |
| 197 | - Encryption practices |
| 198 | |
| 199 | However, Netdata is **not officially PCI DSS certified**. |
| 200 | Entities needing full PCI DSS compliance must perform additional assessments. |
| 201 | |
| 202 | :::tip |
| 203 | |
| 204 | Consult a PCI DSS compliance expert if you use Netdata as part of your PCI environment. |
| 205 | |
| 206 | ::: |
| 207 | |
| 208 | ### HIPAA Alignment |
| 209 | |
| 210 | Netdata aligns with HIPAA security practices: |
| 211 | |
| 212 | - Minimized data handling |
| 213 | - Secure authentication and encryption |
| 214 | |
| 215 | Netdata provides **Business Associate Agreements (BAAs)** for healthcare organizations but is **not HIPAA-certified**. |
| 216 | |
| 217 | :::tip |
| 218 | |
| 219 | Request a BAA through Netdata Support if required. |
| 220 | |
| 221 | ::: |
| 222 | |
| 223 | ### SOC 2 Compliance |
| 224 | |
| 225 | <img src="https://netdata.cloud/img/SOC2 T2 - green - h.png" width="150" alt="SOC2 Badge"/> |
| 226 | |
| 227 | Netdata achieved SOC2 Type 2 compliance for these Service Criteria: |
| 228 | |
| 229 | | **Principle** | **Practices** | |
| 230 | |:---------------------|:-----------------------------------------| |
| 231 | | Security | TLS encryption, strict access controls | |
| 232 | | Availability | Resilient systems, continuous monitoring | |
| 233 | | Confidentiality | Metadata isolation, role-based access | |
| 234 | |
| 235 | ## Conclusion |
| 236 | |
| 237 | Netdata gives you a secure and transparent way to monitor your systems. |
| 238 | |
| 239 | With clear separation of observability data and metadata, strong encryption, secure authentication, and compliance with international standards, you retain full ownership and control of your system insights. |
| 240 | |
| 241 | :::tip |
| 242 | |
| 243 | **You** are always in control of your data with Netdata. |
| 244 | |
| 245 | ::: |
| 246 | |
| 247 | Netdata’s commitment to **security, privacy, and transparency** ensures that your monitoring environment stays **protected** and **trusted** at every step. |