Security & privacy
What Obsevo can see
This page states what is true today. It is not a compliance posture, and there is nothing aspirational on it — where something is not done, it says so.
The short version
Obsevo is designed so that the interesting parts of your data never reach it. The agent reduces executions to metadata on your own host and sends numbers. What Obsevo stores is names, statuses, timings and counts.
There is one exception, and it is the first thing on this page rather than a footnote.
What the agent sends
Per run, and per node within it:
- Workflow id and name
- Node names and types
- Run status, mode and timing
- Items out, per node and per branch
- Error text and a classification bucket
- For AI nodes: model name, provider, token counts
- Execution payloads — the data flowing between nodes — never sent
- Prompt and completion content — never sent
- Credentials of any kind — never sent
- Arbitrary node parameters (expressions are stripped) — never sent
Error text is the one field that carries free-form content, because a truncated error is not actionable. If your workflows put customer data into error messages, that data will reach Obsevo.
How the agent talks to us
- Outbound only. The agent opens connections; nothing connects to it. It needs no inbound firewall rule and works from inside a private network.
- Signed. Every batch carries an HMAC over the exact bytes sent, plus a timestamp and a one-time nonce. Timestamps outside a five-minute window are rejected, and a replayed nonce is refused.
- Read-only against n8n. API mode needs only a read-scoped key; DB mode documents a
SELECT-only role. Writes require a separate key you opt into.
What we store, and for how long
Credentials for connected instances are encrypted at rest with envelope encryption under a master key held by the deployment. Log values under credential-shaped keys are redacted on arrival, before storage.
Third-party services
The application ships no third-party client-side scripts and no telemetry. No Sentry, no analytics, no session replay, no tag manager. Authentication is first-party rather than delegated to an identity provider. You can confirm all of this from the network tab, which is the point of saying it.
Obsevo Cloud uses a payment processor for billing. The current list is on the subprocessors page.
Snapshots, and the absence of backups
Obsevo Cloud keeps no off-site backups.We would rather say so here than have you assume otherwise. A snapshot of the database is taken on the server immediately before any schema migration, and a deploy that cannot take one does not proceed — so a bad migration can be rolled back. That snapshot sits on the same machine as the database and does not survive the loss of that machine.
What this means in practice: a failed migration is recoverable, and a lost server is not. We will update this section when that changes.
Reporting a vulnerability
Email contact@obsevo.com, privately. You will get a first response within three working days, and an update at least every fortnight until it closes.
We will not pursue action against anyone reporting in good faith who avoids privacy violations, data destruction and service disruption while testing. There is no bounty — there is credit in the advisory, under whatever name you want or none.
What we have not done
Obsevo has no SOC 2 report, no ISO 27001 certification and no third-party penetration test. It is a young project, and claiming otherwise would be worse than saying so. What this page describes is what is actually built, and it is written to be checked against the product rather than taken on trust.