Written down, in public, before you have to ask. Where the answer is unflattering it is still here — a security review that discovers a gap we hid is a review we deserve to fail.
ClawMetry runs as a daemon on the same machine as the agent. It reads what the agent already writes and builds a local store on that machine. Nothing about that changes between deployment modes — what changes is where the dashboard reading that store lives.
In self-hosted and air-gapped deployments, nothing ever leaves your perimeter. In the managed cloud, the daemon pushes an encrypted snapshot to us; it is encrypted with a key we do not hold, so what we store is ciphertext and what your browser renders is the plaintext it decrypted locally.
The daemon makes outbound HTTPS connections only. It opens no inbound ports and requires no firewall exception for us to reach you.
In managed cloud mode only. In self-hosted and air-gapped modes this table is empty.
| Destination | Port | Purpose | Contents |
|---|---|---|---|
| ingest.clawmetry.com | 443 | Snapshot sync | Client-side encrypted payload |
| app.clawmetry.com | 443 | One first-run install ping | Anonymous install counter |
| pypi.org | 443 | Update checks | Version query only |
The dashboard itself listens on localhost:8900 and is not exposed off the machine unless you choose to expose it. Container session discovery, when enabled, reads the local Docker socket.
| Provider | Purpose | What they see |
|---|---|---|
| Google Cloud Platform | Hosting, database, secret storage | Encrypted snapshots, account records |
| Stripe | Payments and subscription billing | Billing details; we never see card data |
| Resend | Transactional email | Email address and message content |
| Anthropic | AI-assisted features in the product | Only content you submit to those features |
| Calendly | Scheduling, if you book a call | Name, email, meeting time |
This list is published for orientation and is accurate to the best of our knowledge at the time of writing. The list that is contractually binding is the one issued with your Data Processing Agreement. Ask for it and check it against this page — if they disagree, the DPA wins and we want to know.
Self-hosted and air-gapped deployments use none of these for your telemetry.
We are a small company. We are not SOC 2 certified and not ISO 27001 certified, and we are not going to imply otherwise with a logo. If your process treats either as a hard gate, tell us on the first call and we will tell you honestly whether the timeline works.
What we can put in your hands instead:
Where a certification is genuinely required by a signed contract, we will scope and commit to it as part of that contract rather than claim it in advance.