Privacy

Last reviewed 7 August 2026

What Promtact processes, where it is kept, how long, and who can reach it.

Two situations, two answers

Self-hosted. You run the binary on your own infrastructure. All data stays there. Promtact receives nothing: no telemetry, no phone home, no licence check that transmits usage.

Hosted. Promtact operates the service on your behalf and is a processor: your data is processed to provide the service and on your documented instructions.

What the system sees

Promtact inspects agent tool calls, so it stores the timestamp, the tenant, the machine and account making the call, the source address, the tool name, and the call's arguments.

The honest part: a tool call's arguments are whatever the agent passed — a query, a file path, an email body, a customer record. Promtact cannot know in advance what your agents handle, so it must be assumed that this field can contain personal data.

This is inherent to the function: a control that decides whether a call may proceed has to see the call. What follows is that retention and access control are the real protections, not a claim that nothing sensitive is processed.

Retention

Events, alerts, response actions and audit records are deleted after the retention window, 30 days by default and configurable per deployment. Deletion is by age; there is no separate archive.

Tenant accounts, their users and API key hashes are kept until the tenant is deleted, as is the audit chain state — discarding it would break the tamper-evidence of everything remaining.

Encryption

In transit: TLS terminates at Cloudflare and reaches the origin over an outbound-only tunnel. The service binds to loopback and is not directly reachable.

At rest: values that are verifiers — API keys, recovery codes — are stored only as hashes and cannot be recovered. Values that must be readable to work, currently only TOTP seeds, are sealed with envelope encryption: a per-record key wrapped by a key held outside the database.

Not switched on in the hosted deployment. Envelope encryption is opt-in and is currently not enabled there. Full-database encryption at rest is a property of the underlying storage and is not provided by Promtact.

Location and sub-processors

Provider	Purpose	What it reaches
Cloudflare	TLS, tunnel, alert receiver	Request metadata in transit; alert summaries
Hosting provider	Virtual machine and storage	Everything, at the infrastructure layer

The hosted deployment runs on a single virtual machine in Europe, with the database on the same host. Integrations you configure yourself — a webhook, a ticket system, a SIEM — are your choice and your relationship, not sub-processors of Promtact.

Your rights

For the hosted service you are the controller and Promtact assists as processor: locating records for an identified person, correcting them, or deleting them ahead of the retention window.

Because tool call arguments are free-form, a deletion request may require searching those fields rather than a keyed lookup. That is slower, and saying so is more useful than implying a clean index exists.

Contact

Data protection enquiries: privacy@promtact.com
Security reports: see Security.

The full version of this document, kept with the code and updated alongside it, is docs/data-protection.md.