Legal
Security
Last updated October 23, 2026
Infrastructure data is sensitive. This page summarises the controls we use to protect it, and how to report a concern.
Encryption
TLS 1.2+ in transit and AES-256 at rest. Agent enrollment tokens are single-use and stored only as SHA-256 hashes.
Tenant isolation
Every query is scoped by organisation at the service layer, backed by row-level indexes and automated cross-tenant access tests in CI.
Authentication
Firebase Authentication with email/password, Google, GitHub and SAML SSO on Enterprise. Session tokens rotate and can be revoked per device.
Authorisation
Role-based access control (Owner, Admin, Member, Viewer) with server-side permission checks on every endpoint.
Audit trails
Security-relevant actions are recorded with actor, IP address and user agent. Owners can export audit logs.
Least privilege
The monitoring agent runs as an unprivileged service, sends data outbound only, and never accepts inbound commands by default.
Data residency
Production telemetry is stored in Kathmandu (ktm-1) with encrypted backups in Singapore (sin-1). Enterprise customers can require single-region storage. Transfers rely on standard contractual clauses where applicable.
Retention and deletion
Retention follows your plan. Deleting a workspace triggers a 30-day grace period, then telemetry is purged; backup copies expire within 35 days. Deletion requests can be made from settings or by email.
Incident response
We triage security reports within one business day and aim to notify affected customers within 72 hours of confirming a data breach. Our on-call rotation is staffed 24/7 for platform incidents. A public post-incident report is published for material events.
Responsible disclosure
Please report vulnerabilities to security@prahari.dev with steps to reproduce. Do not access other customers’ data, run destructive tests, or disclose the issue publicly before we have had a reasonable chance to fix it. We will acknowledge your report, keep you updated, and credit you if you wish.
Subprocessors
We use reputable providers for cloud hosting, PostgreSQL, email/SMS delivery, payment processing and error tracking. A current list is available to customers on request. We review their security posture before onboarding and at least annually.