Privacy by architecture, not by policy.
Your operational data stays on your own infrastructure. OmniSight is self-hosted: events, alerts, and everything your endpoints generate are stored on your server. Our managed services handle account and licensing state, plus the optional email delivery you choose to switch on.
Boundaries We Enforce Architecturally
These are properties of how the current release is built, not promises about our intentions. Each one is testable against the shipped product.
Where Your Data Lives
Three boundaries, clearly separated.
Endpoint Agent
HTTPS-only transport with certificate validation. The agent observes connection metadata — it does not redirect, inject, or decrypt traffic.
Your Self-Hosted Server
Local API service and local SQLite event store run entirely on your infrastructure. Events, alerts, and operational data stay in your environment.
OmniSight Managed Services
Account state, signed entitlement leases, and private artifact delivery. If you switch on managed email delivery, bounded alert metadata and aggregate report summaries transit the relay; a webhook to your own endpoint avoids it. Event content and secrets do not pass through.
Security & Control
Enterprise-grade protection is baked into the core, not bolted on as an afterthought.
JWT Authentication
Short-lived signed sessions with issuer and audience claims, refresh token rotation, and TLS 1.3 enforcement.
Refresh Token Rotation
Automatic token cycling with theft detection and family-based revocation. Stolen tokens are instantly invalidated across the entire session chain.
Session Invalidation
Password changes instantly revoke all active sessions. Token versioning ensures no stale credentials remain valid.
Audit Logging
Auditable administrative logs with bounded retention for privileged actions taken within the platform.
Protection Layer
Rate limiting on all API endpoints, bcrypt password hashing, HttpOnly secure cookies, and security response headers (HSTS, CSP, X-Frame-Options, Referrer-Policy) to mitigate XSS, CSRF, and clickjacking risks.
Agent Security Boundaries
What the agent guarantees, by design.
| Boundary | Guarantee |
|---|---|
| Connection metadata | Collected by default. Process, protocol, remote address, timing, and volume — the fields the console exposes in Events Search |
| Packet payload capture | Not collected in this release. The agent reads connection metadata; payload bytes are not read, stored, or transmitted |
| TLS interception | Not performed. No MITM, SSL bumping, or certificate spoofing, and no OmniSight root certificate is installed in any trust store |
| Traffic modification | Not performed. The agent observes; it does not redirect, inject, block, or rate-limit |
| Data location | Your infrastructure. Events, alerts, inventory, and reports are stored by your self-hosted server. Nothing is transmitted to OmniSight unless you switch on managed email delivery — see the row below |
| Managed services scope | Account state, signed entitlement leases, and private artifact delivery. Managed email delivery is opt-in and off unless you enable it; when it is on, bounded alert metadata — the rule title and the affected host — and aggregate report summaries transit the relay. Sending notifications to your own webhook endpoint keeps them off it entirely. Event content and secrets do not pass through |
| Secure transport | HTTPS with certificate validation |
| CVE matching | Package metadata only. Raw CVE detail shows public NVD data; endpoint files and payloads are not sent to the lookup service |
| System metrics | Aggregate numeric values only — no command lines, per-connection tuples, ports, destinations, or secrets |
Want the full technical architecture?
Read the complete security and RBAC reference, including token model, entitlement enforcement, and audit trail detail.