Security & Trust
Protect your platform with control over the data you send and the actions PuppetWatch may take.
Data minimisation
Send pseudonymous identifiers and action metadata. Emails and message content are not required. Content signals use hashes rather than raw content; identifiers should remain pseudonymous.
Your application should keep the mapping between pseudonymous identifiers and real users. Avoid putting personal details into identifiers or metadata.
EU hosting
PuppetWatch is EU-hosted, including AI-assisted analysis. See our subprocessors for the providers involved.
You define the boundaries
Set which restrictions are allowed for each application action. PuppetWatch chooses a response within those limits. Begin in monitor-only mode and review decisions before enabling enforcement.
Data processing agreement
A DPA is available for every customer. Request a DPA.
Retention and deletion
| Data category | Retention information |
|---|---|
| Pseudonymous event and account data | Request the applicable retention schedule before integration. |
| Derived investigation data | Request the applicable retention schedule before integration. |
| Business enquiries | Contact us for retention and deletion details. |
For a deletion request, contact hello@puppetwatch.com with your project reference. Do not include raw end-user personal details in the initial email.
Security information and incident contact
For encryption, access-control, audit-log and incident-response documentation, or to report a security concern, contact hello@puppetwatch.com.
Review and reversal workflow details will be published when that system is live.