Rangehead
Security

The answers your security review is going to ask for

Written down, in public, before you have to ask. Where the answer is unflattering it is still here — a security review that discovers a gap we hid is a review we deserve to fail.

The shape of it

Collection is local. Always.

ClawMetry runs as a daemon on the same machine as the agent. It reads what the agent already writes and builds a local store on that machine. Nothing about that changes between deployment modes — what changes is where the dashboard reading that store lives.

In self-hosted and air-gapped deployments, nothing ever leaves your perimeter. In the managed cloud, the daemon pushes an encrypted snapshot to us; it is encrypted with a key we do not hold, so what we store is ciphertext and what your browser renders is the plaintext it decrypted locally.

The daemon makes outbound HTTPS connections only. It opens no inbound ports and requires no firewall exception for us to reach you.

Controls

What is in place today

Read-only by defaultThe product observes. Enforcement — budget limits, tool policy, kill switch — is opt-in and configured by you.
Encryption in transitTLS to every endpoint. Cloud snapshots are additionally encrypted end-to-end before transmission.
Snapshot encryptionAES-256-GCM with a 96-bit nonce per payload. Passphrase-derived keys use scrypt. The key is generated and held on your machine.
Secret redactionEvents pass a redaction stage before they are stored, exported, or forwarded, so credentials that appear in agent output do not propagate.
Tamper evidenceAudit events are hash-chained. A modified or removed record breaks the chain and is reported as broken.
Supply chainCycloneDX SBOM, automated dependency auditing, build provenance, and byte-comparison of vendored dependencies against their published sources.
Distribution integrityPublished through PyPI Trusted Publishing. Windows artefacts are code-signed and timestamped.
Vulnerability reportingA published security policy with a disclosure address in the public repository.
Egress

What leaves the machine, and where it goes

In managed cloud mode only. In self-hosted and air-gapped modes this table is empty.

DestinationPortPurposeContents
ingest.clawmetry.com443Snapshot syncClient-side encrypted payload
app.clawmetry.com443One first-run install pingAnonymous install counter
pypi.org443Update checksVersion query only

The dashboard itself listens on localhost:8900 and is not exposed off the machine unless you choose to expose it. Container session discovery, when enabled, reads the local Docker socket.

Subprocessors

Who else touches data, in managed cloud mode

ProviderPurposeWhat they see
Google Cloud PlatformHosting, database, secret storageEncrypted snapshots, account records
StripePayments and subscription billingBilling details; we never see card data
ResendTransactional emailEmail address and message content
AnthropicAI-assisted features in the productOnly content you submit to those features
CalendlyScheduling, if you book a callName, email, meeting time
Read this before you paste it into a DPA

This list is published for orientation and is accurate to the best of our knowledge at the time of writing. The list that is contractually binding is the one issued with your Data Processing Agreement. Ask for it and check it against this page — if they disagree, the DPA wins and we want to know.

Self-hosted and air-gapped deployments use none of these for your telemetry.

Certifications

What we do not have

We are a small company. We are not SOC 2 certified and not ISO 27001 certified, and we are not going to imply otherwise with a logo. If your process treats either as a hard gate, tell us on the first call and we will tell you honestly whether the timeline works.

What we can put in your hands instead:

  • A CSA CAIQ self-assessment. In preparation — ask and we will send you the current draft rather than make you wait for the final.
  • This architecture and data-flow documentation, in writing.
  • Our subprocessor list and a Data Processing Agreement.
  • A compliance evidence bundle generated from your own environment during a pilot — the product produces these, so it is your data rather than our sample.
  • The source code, which is more than most certified vendors will give you.

Where a certification is genuinely required by a signed contract, we will scope and commit to it as part of that contract rather than claim it in advance.