Do not believe us.
Read the agent.
Monitoring software runs with real privileges on machines you are paid to protect. That deserves more than a marketing page and a badge wall. Here is the actual model, in the order a security review asks about it.
The agent you can audit
The agent is a single static Go binary whose full source is public under the Elastic License 2.0. It executes nothing from a raw shell: anything a check runs comes from an allow-list of binaries, probes run with the least privilege that still gets the data, and the whole surface fits in one code review. When a client's security team asks what exactly you installed on their servers, the answer is a public repository, not a promise.
Transport and identity
The agent holds one outbound WebSocket over TLS with certificate pinning. The platform never dials your servers, so no inbound ports open, and NAT changes nothing. Registration uses a team key exactly once: it authenticates the bootstrap exchange, then it is discarded, never written to disk. Each host receives its own key, stored as machine-bound ciphertext and rotated automatically every 7 days. A copied identity file is useless off its machine, and a leaked team key is revocable and rate-limited.
Secrets stay where they belong
Database passwords, SNMP credentials and every other secret are stored encrypted on the host and referenced by name in monitoring logic. The server pushes checks down; it has no mechanism to pull secret values up. This is a structural property, not a policy: a compromise of our platform does not expose your credentials, because they were never here.
Signed logic, previewed execution
Monitoring logic arrives as declarative definitions signed by a publisher key, and the agent verifies the signature before anything runs. Community definitions from the marketplace carry their author's signature, and the console shows the exact commands and queries a definition will execute before its first run. You approve, then it runs. Binary updates travel the same signed channel: a signed release manifest carries every checksum, each binary carries its own signature, and a monotonic issue date on the manifest means a rollback to an older build is refused on the host itself.
Your services are not ours to restart
Some changes need a service reload, like loading an APM extension into PHP. The agent stages the change, the console shows the precise command with its impact, and a human applies it in a window they choose. The agent never restarts a client service on its own. This single rule has outsized value on regulated infrastructure, and it is enforced in code, not in a runbook.
Leaving is one command
Offboarding is designed with the same care as onboarding. wakora uninstall stops the service, wipes local state and removes the binary itself; deregistration revokes the host's keys and purges its telemetry from our storage, honoring GDPR erasure rather than merely promising it. Removing a host from the console sends the agent a removal order signed by our publisher key and addressed to that host alone, so nothing short of that signature can wipe a machine. An easy exit is part of the trust model: you stay because it works, not because leaving is hard.
The platform side
Telemetry is stored in the EU, encrypted at rest, with retention set by plan. The console supports two-factor authentication, trusted-device management and a sign-in journal on every account; SSO with Microsoft, Google, Slack and domain join on Business and above. Roles are least-privilege, and actions that matter land in an append-only audit log: who acknowledged, who changed a threshold, who exported what, including actions performed by AI agents through MCP. Backups and restore paths are tested, and our own status page at status.wakora.io is fed by an independent watchdog, so a bad day for us is visible to you in real time.
Anti-abuse, because alerting spends real money
Phone numbers must be verified by a code before they can receive calls. Premium-rate ranges are blocked, destinations are geo-limited by default, and every tenant has volume caps and a spend cap. These controls protect you from a compromised account as much as they protect us.
Compliance posture
GDPR from day one: EU residency, an Article 28 DPA with a short published subprocessor list, PII minimization by design (monitoring data is about machines, not people). Our internal controls follow SOC 2 and ISO 27001 lines: change management, access reviews, risk assessment, an incident response plan we practice. Formal certification follows customer demand; the point of the controls is that they hold today, and the trust pack lets your reviewers verify that claim now rather than wait for a certificate.
And if you run a WAF in front of your sites, our external probes are easy to be nice to: fixed published addresses, an honest user agent that names itself, and per-origin pacing, all on one page your firewall team can allow-list from.
Responsible disclosure
Found something? Write to [email protected]. We acknowledge within one business day, we do not threaten researchers, and we credit fixes publicly if you want the credit. If the report touches the agent, a public repo means you can point at the exact line.
Send this page to your security team.
Then send them the agent's source. That order works best.