Privacy Policy
Effective date: April 7, 2026 · Last updated: July 22, 2026
Overview
Seismograph is a monitoring platform that monitors your infrastructure endpoints, SaaS dependencies, and deployment activity. This policy explains what data we collect, how we use it, and how we protect it.
We collect only what is necessary to provide the service. We do not sell your data. We do not share your data with third parties except as required to operate the service.
What We Collect
Infrastructure Monitoring Data
When you onboard with Seismograph, you provide:
- ✓Endpoint URLs you want monitored
- ✓Expected response codes and performance thresholds
- ✓SaaS vendor dependencies your endpoints rely on
- ✓GitHub repository webhook configurations
- ✓Endpoint authentication credentials when required for customer-configured monitoring
We collect the following through active monitoring:
- ✓HTTP response codes and latency (TTFB) for your declared endpoints
- ✓DNS resolution times for declared dependencies
- ✓Deployment metadata from GitHub webhook events (commit SHA, branch, author name, commit message, repository name, timestamp)
Notification Integrations
- ✓Email addresses you designate to receive notifications
- ✓Slack OAuth credentials when you choose to connect a Slack workspace
Slack is connected through OAuth; Seismograph does not ask customers to supply Slack webhook URLs. We use integration credentials only to perform the customer-configured notification functions.
Account Data
- ✓Your name and email address
- ✓Your company name
- ✓Communication history with hello@seismograph.ai
Website Data
When you visit seismograph.ai:
- ✓Standard web server logs (IP address, browser type, pages visited, timestamps)
- ✓No tracking pixels, no advertising cookies, no third-party analytics
What We Do Not Collect
- ✓We do not collect the contents of your API requests or responses
- ✓We do not collect authentication credentials from your monitored endpoints unless you choose to provide credentials for customer-configured monitoring. When provided, endpoint-monitoring credentials and Slack OAuth credentials are securely stored in AWS Secrets Manager.
- ✓We do not collect user data from your application or your customers
- ✓We do not use cookies for tracking or advertising
How We Use Your Data
We use collected data exclusively to:
- ✓Monitor your declared endpoints and report their health status
- ✓Detect degradation and generate alerts
- ✓Correlate your endpoint failures against global infrastructure signals
- ✓Identify deploy-related incidents via GitHub webhook data
- ✓Deliver notifications by email and, when you connect it through OAuth, Slack
- ✓Use credentials only to perform the customer-configured monitoring or integration functions
- ✓Improve detection accuracy over time using aggregated baseline data
Data Retention
| Data type | Retention period |
|---|---|
| Probe results (TTFB, status codes) | 30 days |
| Alert records | 7 days |
| Baseline statistics | 30 days rolling |
| Deploy records (GitHub webhook) | 7 days |
| Global infrastructure snapshots | 1 hour |
| Account data | Duration of engagement + 90 days |
Data is automatically deleted after the retention period via AWS DynamoDB TTL.
Data Storage and Security
All data is stored on AWS infrastructure in the us-east-1 region (Northern Virginia).
- ✓Encryption in transit: TLS 1.2 or higher for all data transmission
- ✓Encryption at rest: AWS KMS encryption for all DynamoDB tables
- ✓Access control: Client dashboards use passwordless email authentication and client-level authorization controls.
- ✓Secrets management: Customer-supplied endpoint-monitoring credentials and Slack OAuth credentials obtained when you connect Slack are encrypted and securely stored in AWS Secrets Manager, with access limited to application components that require them
- ✓Data isolation: Each client's data is logically isolated. Client A cannot access Client B's data.
Cross-Client Signal Aggregation
- ✓When multiple clients declare the same vendor dependency and experience simultaneous endpoint failures, Seismograph infers a vendor-wide incident with higher confidence
- ✓This aggregation uses only anonymized signal data (degradation counts, timestamps, vendor names) — never client identity, endpoint URLs, or any client-specific information
- ✓No client can see another client's data, endpoints, or alerts
Third-Party Services
Seismograph uses the following third-party services to operate:
| Service | Purpose | Data shared |
|---|---|---|
| AWS (Lambda, DynamoDB, API Gateway, Secrets Manager) | Infrastructure | All monitoring data stored here |
| Cloudflare | CDN and edge delivery | Web traffic |
| AI API provider | AI-powered incident diagnosis | Alert context (anonymized signal data, no client PII) |
| Infrastructure intelligence provider | Global infrastructure signals | No client data — read-only public API |
| GitHub | Webhook delivery | Deploy metadata you send via webhook |
| Slack | Optional OAuth integration and alert delivery | OAuth credentials and alert content when you connect Slack |
We do not use advertising networks, data brokers, or analytics platforms.
Your Rights
You have the right to:
- ✓Access your data — request a copy of all data Seismograph holds about you
- ✓Correction — request correction of inaccurate data
- ✓Deletion — request deletion of your data at any time
- ✓Portability — receive your data in a structured, machine-readable format
- ✓Objection — object to specific uses of your data
To exercise any of these rights, email hello@seismograph.ai. Requests will be completed within the timeframe required by applicable law.
Data Deletion
When your engagement with Seismograph ends:
- ✓All monitoring data is deleted within 30 days
- ✓Account data is deleted within 90 days
- ✓Baseline statistics are deleted within 30 days
- ✓GitHub webhook configurations should be removed from your repositories
To request immediate deletion of all data, email hello@seismograph.ai with subject line "Data Deletion Request."
GDPR
If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR):
- ✓Legal basis for processing: Contractual necessity (to provide the monitoring service you have engaged us for)
- ✓Data controller: Seismograph (hello@seismograph.ai)
- ✓Data transfers: Data is stored in AWS us-east-1 (United States). We rely on standard contractual clauses for any EEA data transfers
- ✓Supervisory authority: You have the right to lodge a complaint with your local data protection authority
Changes to This Policy
We will notify you of material changes to this policy via email to your registered address at least 14 days before changes take effect. The current version is always available at seismograph.ai/privacy.
Seismograph is a product of Seismograph AI. © 2026 Seismograph. All rights reserved.