Legal
Nossic Ops data processing terms
Version 1 · 17 October 2026
In short
- When you monitor machines with Nossic Ops, you are the controller of any personal data in what the agent sends (such as user account names, addresses and, if you switch them on, log lines), and Nossic processes it for you.
- We only use it to run Nossic Ops for you, keep it in the UK, keep it secure, and delete it on the schedule below or when you remove it.
- These terms are part of the Nossic Ops terms, which an owner or admin accepts for their organisation.
These terms meet Article 28 of the UK GDPR and the EU GDPR. They apply between Nossic ("we") and the organisation using Nossic Ops ("you"), alongside our privacy notice.
1. The processing
| Subject matter | Monitoring the machines, services and websites you choose with Nossic Ops: collecting what nossic-ops-agent reports, running checks, keeping history, opening incidents and sending alerts. |
| Duration | While you use Nossic Ops, then until the data is deleted under section 9. |
| Nature and purpose | Receiving, storing, showing, analysing and alerting on monitoring data for you; doing the actions you ask an agent to do (only those its machine allows). |
| People | People who use or are named on the machines you monitor (for example in user accounts or log lines); your team members; people you add as alert recipients. |
| Personal data | User account names and whether they're administrators; host names and IP addresses; names of processes and services; log lines (only if you switch logs on for a host), which may contain anything your systems write to their logs; counts of failed logins; email addresses, phone numbers and webhook addresses you add for alerts; your team's names and emails. |
| Special categories | Not intended. If your logs may contain special category data, don't switch log collection on for those machines, or filter what they log. |
2. Your instructions
We process the data only on your documented instructions: these terms, your organisation's settings and what your team does in Nossic Ops. If the law makes us do otherwise, we'll tell you first unless the law forbids it. We don't use your data for our own purposes, sell it, or use it to train AI models.
Alerts go where you tell us: email addresses, phone numbers, Discord channels and webhook addresses you add. Discord, your webhook receivers and your own mail providers are yours to choose, not our sub-processors.
3. Confidentiality
Everyone at Nossic who can access the data is bound to keep it confidential and accesses it only when needed to run, support or secure the service.
4. Security
Encryption in transit (HTTPS); agents that only connect out and authenticate with their own key (kept only as a hash); each organisation's data separated by access controls; channel addresses stored encrypted; checks from our servers refused for private addresses; servers in a private network reachable only through our gateway; access limited to authorised staff with strong authentication; encrypted backups; software kept up to date.
5. Sub-processors
| Sub-processor | What for | Where |
|---|---|---|
| DigitalOcean | The gateway server that carries encrypted traffic between the internet (including your agents) and our servers | London, UK |
| OVHcloud | The mail gateway that alert emails leave through | Canada for now, moving to the UK |
| Browser push services (Google, Mozilla, Microsoft, Apple) | Only for people who turn on push alerts: delivering them. Encrypted so only the device can read them. | Mostly the United States |
When SMS alerts are switched on, we'll add the SMS provider here first. We'll give at least 30 days' notice on this page and by email to organisation owners before adding or replacing a sub-processor, so you can object.
6. Where the data goes
We store and process the data in the UK. We won't transfer it outside the UK or the European Economic Area unless the law allows it and the required safeguards are in place.
7. Helping you
- People's rights: you can find and delete a host's data (remove the host), search and stop log collection, and remove alert recipients yourself. We'll help with anything you can't, and pass on any request someone sends us.
- Breaches: we'll tell you without undue delay, and within 48 hours of becoming aware, of a personal data breach affecting your data.
- Assessments: we'll give reasonable help with data protection impact assessments and consultations with regulators about Nossic Ops.
8. Information and audits
We'll give you the information you reasonably need to show these terms are being met, and allow and contribute to audits by you or an auditor you choose, with reasonable notice, confidentiality and no more than once a year unless a regulator requires it or there's been a breach.
9. Retention and deletion
- Detailed numbers 48 hours; averages 30 days (free plan) or 13 months; check results and alert deliveries 90 days; incidents and changes 13 months; log lines 3, 14 or 30 days by plan.
- Removing a host deletes its numbers, logs, changes and checks straight away. Deleting your organisation deletes everything in it.
- Encrypted backups are overwritten within 5 weeks.
10. Your part
- Have a lawful basis for monitoring the machines you install the agent on, and tell the people who use them where needed (for example in your staff privacy notice).
- Only switch log collection on where you need it, and keep the minimum level you need.
- Only add alert recipients who have agreed to get alerts.
11. Other terms
These terms last as long as we process data for you. If they conflict with any other terms between us about personal data, these terms win. Questions: privacy@nossic.uk.