---
title: "Security"
description: "Where LogBrew stores your data, how it is protected, which providers process it, and how to report a vulnerability."
canonical: "https://logbrew.co/en/security"
last_updated: "2026-10-31"
---

# Security

Where LogBrew stores your data, how it is protected, which providers process it, and how to report a vulnerability.

Updated October 31, 2026

Canonical: https://logbrew.co/en/security
HTML: https://logbrew.co/en/security

## Data location

- Account data, project data, telemetry, and uploaded files are stored in Germany, in a data center in Nuremberg. Backups are stored in Germany, in a data center in Falkenstein.
- Requests pass through Cloudflare's global network before they reach the servers in Germany.

## Encryption in transit

- logbrew.co, api.logbrew.co, and mcp.logbrew.co accept TLS 1.2 and TLS 1.3 only. Connections that use TLS 1.0 or 1.1 are refused.
- Traffic between Cloudflare and LogBrew's servers is also encrypted, and Cloudflare verifies the server certificate. The servers accept TLS 1.2 and 1.3 only.
- Browsers must use HTTPS. Every response sends HSTS for 2 years, with subdomains and the preload flag.
- DNS answers are signed with DNSSEC. Mail to logbrew.co requires TLS (MTA-STS), and mail that fails DMARC is rejected.
- Backups travel to backup storage over SSH, and older telemetry travels to object storage over HTTPS.

## Encryption at rest

- Telemetry older than 30 days moves to object storage. Each object is encrypted with AES-256 under a key that only LogBrew holds, so the storage provider cannot read it.
- Stored repository access tokens, webhook URLs, and webhook signing secrets are encrypted with AES-256-GCM, each under its own derived key.
- Project API keys and agent refresh tokens are stored only as SHA-256 hashes, so a copy of the database does not reveal a usable key.
- Uploaded source maps and native symbol files are encrypted with X25519 public-key encryption before they leave the server for backup storage. The decryption key is never kept on backup storage. Each backup set is signed, and a restore refuses a set whose signature does not match.

## Access control

- You sign in only with GitHub, GitLab, Bitbucket, or Google. LogBrew stores no passwords.
- Web sessions use HttpOnly cookies and last up to 30 days. Signing out ends the session on the server, not only in the browser.
- Organizations have 3 roles. Owners manage billing and deletion. Admins manage members but do not see projects automatically. Members see only the projects assigned to them.
- Ingest keys can only send data, and read keys can only read it. The project owner can revoke a key at any time. Agents connect over OAuth with your consent.
- Only the LogBrew team can reach production servers, from managed devices over an encrypted private network with key-based login. Production changes deploy only from reviewed code that passed automated checks.

## Retention and deletion

- Telemetry is kept for your plan's retention window: 30 days on Free, 90 on Pro, 365 on Business, and your contract's period on Enterprise (365 until a contract sets one). It is deleted 1 to 8 days after the window ends. A move to a shorter window deletes older telemetry within a day. Usage and billing records are kept.
- Deleting a project stops ingestion at once, and the project's live data is deleted automatically a few minutes later. Deleting an account disables access at once and keeps a 24-hour restore window, then deletes the account's live data and ends its paid plan.
- Backups exist only for disaster recovery and never serve the product. The full set restores on a fresh server, and a restore check runs every day.

## Report a vulnerability

- Email security@logbrew.co. The address is also published in security.txt at logbrew.co/.well-known/security.txt.
- LogBrew welcomes good-faith security research that follows the Acceptable Use Policy and takes no action against it.

## Subprocessors

These providers process customer data for LogBrew. LogBrew gives notice when this list changes.

| Provider | What it does for LogBrew | Data it processes | Where |
| --- | --- | --- | --- |
| Hetzner Online GmbH | Servers, databases, object storage, and backup storage | All account data, project data, telemetry, uploaded source maps and native symbol files, and backups | Germany: Nuremberg for servers and storage, Falkenstein for backups |
| Cloudflare, Inc. | DNS, content delivery, attack protection, and HTTPS at the edge for logbrew.co, api.logbrew.co, and mcp.logbrew.co | Every request in transit: IP address, headers, cookies, and request bodies, including telemetry sent to the API | Cloudflare's global network, at the location nearest the visitor |
| Resend, Inc. | Sends product email, such as invitations and alert digests, and receives mail sent to logbrew.co addresses | Recipient email addresses, teammate names in invitations, alert text (issue titles, project names, rule names, services), and the content of mail you send to support | Sending from the United States, receiving in Ireland |
| Stripe | Checkout, subscriptions, invoices, and the billing portal for paid plans | LogBrew account reference and plan. The payment card, billing email, and address that you enter in Stripe Checkout go to Stripe directly and never reach LogBrew. | United States and Ireland |
| Apple Inc. | Push notifications to the iOS app, only for users who turn them on | Device push token and notification text (alert type, issue title, project name, service) | United States |

LogBrew uses no third-party error tracker or product analytics service. LogBrew's own errors go to LogBrew. The website sets no advertising or analytics cookies.

## Services you connect

These services are not subprocessors. They process data only because you choose to connect them.

| Service | What LogBrew exchanges with it |
| --- | --- |
| Sign-in with GitHub, GitLab, Bitbucket, or Google | LogBrew receives the profile the provider shares: name, email address, avatar, and your user number at that provider. There is no password sign-in. |
| Repositories on GitHub, GitLab, or Bitbucket | When you connect a repository, LogBrew uses your access token to read repository metadata, commits, and the files it needs for source context. |
| Webhooks, including Slack, Discord, and Microsoft Teams | LogBrew sends alert messages only to the URLs you add. |
| Your AI agent | An MCP client or the CLI reads project data only with your consent or key. LogBrew sends no customer data to an AI provider of its own. |