Trust, Security & Privacy

Logs you paste are sent to an AI gateway for analysis. The raw log text is not persisted in our database, only the structured analysis result (headline, timeline, bumps, IOCs, MITRE mapping, pivots) is stored so you can revisit the investigation.

A built-in redaction tool lets you strip IPs, emails, hostnames, and custom patterns before submission. Use it when working with regulated or third-party data.

Investigations are stored in a managed Postgres database (Lovable Cloud / Supabase). Each investigation is keyed by a random owner_token generated in your browser. The token is write-only, it is never returned by the public API.

Investigation results (the analysis output) are readable by anyone with the share link. Do not paste secrets, credentials, or data you do not want to be link-shareable.

There are no user accounts. There is no advertising, no behavioral tracking, no third-party analytics beyond aggregate platform metrics.

• Row-Level Security enabled on all database tables.
• Insert validation: owner tokens must match a strict format.
• No UPDATE or DELETE policies, investigation records are immutable from the API.
• Secrets (AI gateway keys) are server-side only, never shipped to the browser.
• Regular automated security scans of the database and dependency tree.

Log content is processed by the Lovable AI Gateway (currently routing to Google Gemini models) for the duration of the analysis call. We do not control retention or training policies of upstream model providers, review their terms before submitting sensitive data, and use the redactor when in doubt.

If you believe you have found a security issue, please open an issue on the project repository or contact the maintainer. We will respond promptly.