Privacy Policy

DevOps Agent ("we", "us") runs the service at devops-agent.io: a web panel and an AI agent that connect to your Linux servers and cloud accounts. This policy explains what we collect, why, who else handles it, and what you can ask us to do with it. Questions go to support@devops-agent.io.

This policy covers devops-agent.io only. A self-hosted install is run by the company that installed it, and its data never reaches us except the licence check described in that installation's own terms.

What we collect

Your account. Email address, an optional name, a password (stored only as a one-way hash), your workspace, its Account ID and plan, and any team members you add with their role.

Credentials you connect. Server logins (passwords and SSH private keys), AWS access keys, GCP service-account keys, Jenkins and Grafana tokens, and API keys for AI models you add yourself. Server passwords and SSH keys are encrypted with a separate passphrase per server and decrypted only in server memory when a connection is opened. The other secrets are encrypted at rest with AES-256-GCM. None of them is ever shown back in the browser or sent to an AI model.

Data from your servers and cloud accounts. When you open a screen, run a command, or when a background feature runs (health checks every 15 minutes, uptime checks, the monitoring agent, scheduled agents), we read what that feature needs: command output, logs, file and folder listings, service and package lists, resource metrics, cloud inventory and billing data. We do not copy your server's files unless you download them, back them up through the panel, or ask the agent to.

What you create in the product. Chat conversations and the command output inside them, reports and files in File Storage, notes, uptime monitors and incidents, agent settings and run history, database backups you make with the panel, and support tickets with their attachments.

The activity log. A record of the changes made through the panel on each server: who, what and when, including commands typed in the browser terminal. Passwords and tokens in it are masked.

Technical data. Your IP address (used for rate limits and security), browser type, and server logs of requests and errors.

Analytics. We use Umami for page-view counts and Microsoft Clarity for heatmaps and session replays of how pages are used. Clarity masks typed input but can record other text shown on screen.

Advertising. We use the Google Ads tag to measure whether our ads work: it records that a visitor came from one of our ads and whether they later verified an account, connected a first server and got a first chat answer. We don't use it to show you ads on other sites.

Why we use it

• To run the service you asked for: connect to your servers and cloud accounts, run the commands you or your agents request, show results, send the alerts and reports you set up.
• To keep accounts secure: sign-in, email verification, password resets, rate limits, abuse prevention.
• To support you when you contact us.
• To understand which parts of the product are used and fix what breaks.
• To tell you about changes to the service or these terms. We don't send marketing email without your agreement, and we don't sell your data.

AI processing

When you use the chat or an agent with one of our hosted models, your messages, the relevant context (server names, the output of commands and tools the agent ran) and files you attach are sent to OpenAI to produce the answer. Under OpenAI's API terms this data is not used to train their models. If you add your own model, that data goes to the provider you chose, under your agreement with them. Web searches the agent makes are sent to Tavily, and IP addresses it checks for abuse reports are sent to AbuseIPDB.

The AI sees whatever your commands print, so it can see data stored on your servers if a command displays it. Some features mask values that look like secrets, but masking is not guaranteed; don't ask the agent to print secrets you don't want processed.

Who else handles your data

Each handles data only to provide its service to us. Some of them process data outside your country, including in the United States.

How long we keep it

• Activity log: 365 days.
• Uptime check results: 30 days. Incidents stay until the monitor is deleted.
• Monitoring samples: 7 days.
• Chats, files, reports, notes, agents and backups: until you delete them.
• Credentials: until you remove the server, project or integration.
• Account data: until your account is deleted.

Deleted data may remain in routine database backups for a limited time before they are overwritten.

Your choices and rights

You can view and change most of your data in the app, and delete servers, projects, chats, files and integrations yourself. To get a copy of your data, correct it, or delete your account and everything in it, email support@devops-agent.io from the address on the account. We answer within 30 days.

Depending on where you live (for example under India's Digital Personal Data Protection Act 2023, or the GDPR in the EU and UK), you may also have the right to object to or restrict some processing, withdraw consent, and complain to a data protection authority.

Cookies

We set one essential cookie, dcp_token, which keeps you signed in for up to 30 days. Microsoft Clarity sets its own cookies to group page views into a session. Google Ads sets cookies that record which ad brought you here, so we can tell whether an ad led to a sign-up.

In the EU, EEA, UK and Switzerland, Microsoft Clarity and Google Ads set no cookies until you click Accept on the cookie banner. Elsewhere they are on by default. You can change your choice at any time from Cookie settings at the bottom of the home page, the Privacy Policy or the Terms.

In the EU, EEA, UK and Switzerland, Microsoft Clarity and Google Ads set no cookies until you click Accept on the cookie banner. Elsewhere they are on by default. You can change your choice at any time from Cookie settings at the bottom of the home page, the Privacy Policy or the Terms.

Security

Connections to the service use TLS. Secrets are encrypted as described above, access inside a workspace follows the roles you assign, and every account's data is kept separate from every other account's. No system is perfectly secure; if a breach affects your data, we will tell you without undue delay.

Children

The service is for people aged 18 and over and is not directed at children.

Changes

If we change this policy we will update the date above, and for significant changes we will email account owners before they take effect.