Privacy and data processing

Name, email address, a hashed password, the organizations you belong to and your role in each. Used to sign you in and to send password reset and alert emails.

Your servers send one record per HTTP request. Carcha Labs Monitoring processes these records on your behalf. For each record it stores:

• timestamp, method, path, route, status code and response time;
• country code and user agent, when your SDK sends them;
• request and response headers, with authorization, cookie, set-cookie, proxy-authorization, x-api-key, x-auth-token, CSRF and ingest token headers replaced by [redacted];
• request and response bodies only when body capture is enabled for the application. Keys that look like passwords, tokens, secrets, card numbers, IBAN or national ID numbers are replaced by [redacted]; bodies larger than 8 KB are replaced by a truncation marker;
• the client IP address, shortened to /24 for IPv4 and /48 for IPv6 by default. Each application can store the full address or none.

On the Free plan, individual requests are kept for 7 days and per-minute metrics for 30 days. Older data is deleted by a daily job.

Deleting an application deletes its ingest tokens, stored requests and metrics. Deleting an organization deletes all of its applications in the same way. Deleting your account removes your account data.

Only cookies needed to run the service are set. See the cookie list.