Skip to content
Log inContact sales
Security and deploymentLast updated October 2026Worked example · INC-20931

Security and deployment

MonitOps reads data that often contains personal information and, when you allow it, changes production systems. This is how it protects both.

  1. Your own environment.→ Deployment
  2. Personal data masked before storage.→ Data handling
  3. No action without approval.→ Access
Deployment

A dedicated deployment for each customer.

Each customer gets its own environment, in a region agreed with you. Nothing in it is shared with any other customer.

Your sourcesmetrics · logs · traces · alarmsOne credential per source
Region agreed with you
Your dedicated environment
  • Masking at ingestion
  • Telemetry
  • Incidents
  • Audit records
INC-20931RUN-5521
Language model endpointprovider and region agreedBounded tools only · no training
Upgrades operated by MonitOps, in announced maintenance windows
Other customersseparateseparate
Fig. 1 — Where INC-20931 lived. Telemetry, incidents and audit stayed inside one customer's environment.
In detail

MonitOps runs as a dedicated environment for each customer on cloud infrastructure we operate, in a region agreed with you. Your telemetry, incidents and audit records stay in that environment and are not shared with any other customer. Region, data residency, sizing and the upgrade process are agreed before installation. Upgrades are carried out by us as an operated service, with announced maintenance windows.

Availability

Built to keep running through the loss of a zone or a region.

Deployment topologyillustrative
Region A · primaryRunning
Zone 1
ingeststorageconsole
Zone 2
ingeststorageconsole
Zone 3
ingeststorageconsole
Region B · recoveryStandby
ingeststorageconsole
Only where a second region is agreed, within your data residency requirements

Running in 3 zones · recovery region on standby

Fig. 2 — Take out a zone, then the whole region. The exact arrangement is set in your deployment design.
Zone loss
Runs across availability zones, so losing one does not stop MonitOps. Failover arrangements are defined in the deployment design
Region loss
A recovery environment in a second region, agreed with you subject to data residency requirements
Raw telemetry90 days by default · longer if agreed
Aggregates used by reportskept longer
Fig. 3 — Retention, agreed per deployment. Not to scale.
Retention
Raw telemetry kept for 90 days by default, or as long as you need. Aggregates used by reports kept longer
Data handling

Personal data is masked before it is stored.

Masking runs on every ingestion path, before anything is stored or forwarded.

Ingestion30 Sep 2026 · 14:03 ICT
Record
Step 1 of 5 · Received

Held in memory at the collector. Nothing has been written or forwarded.

In memory · not written14:03:12.418 ERROR auth timeout provider=pp-2 card=5412 7534 9921 4417 phone=+66 81 234 5678 cust="Somchai P." latency_ms=30012
Masking rules
  • Card numberspan · mandatory—
  • Phone numbersphone · mandatory—
  • Email addressesemail · mandatory—
  • Thai national ID numbersth-national-id · mandatory—
  • Customer name field custcust-name · your rule—
Fig. 4 — Two records from the INC-20931 window. Switch your rule off to see what it changes. The mandatory rules have no switch.
In detail

Masking runs on every ingestion path before anything is written to storage or forwarded to another system. Your administrators can add masking rules; nobody can remove or bypass the mandatory ones. Records that fail validation are held in quarantine with masked diagnostics, never stored raw.

AI and data

The model works only through bounded, permission-checked tools.

It runs on a model endpoint agreed for your deployment, provider and region included. Your data is not used to train models.

Investigator tool calls · INC-20931as Narin S. · operator · agreed endpoint
  1. 14:03:01metrics.query("payments-gw", "http_5xx", last 30m)
    Allowed
    1 series · 5xx at 31 %
  2. 14:03:02logs.search("payments-gw", "timeout", 14:01–14:03, limit 2000)
    Allowed
    1,284 lines · already masked at ingestion
  3. 14:03:03changes.list("order-api", last 24h)
    Allowed
    0 changes
  4. 14:03:04sql.run("SELECT * FROM payments")
    Refused
    not reached

    No such tool. Data is read only through bounded tools.

  5. 14:03:05rca.set_confidence("payments-gw", 0.95)
    Refused
    not reached

    Confidence is computed by the scorer (0.81). The model cannot set it.

3 allowed2 refusednothing reached data without a tool
Fig. 5 — Every call runs with the asking user's role, bounded in time and size. Two were refused by the tools, not by the prompt.
In detail

The copilot and investigator call a language model endpoint agreed for each deployment, including its provider and region. Your data is not used to train models. The model reads data only through permission-checked, bounded tools; it cannot run arbitrary queries, and it never sets a confidence score, a cause class or an approval.

Access

Every request is checked, and the check is recorded.

One approval from INC-20931, checked step by step. Choose who approves.

P1RUN-5521Fail over card payments · requested by Narin S.
Fig. 6 — Open any check for the full rule. Roles are described in Trust and control.
Ingestion
Each source has its own credential, which can be rotated or revoked without losing configuration
Operability

Failures are visible.

Gaps, stale sources and backlogs appear in the console, next to the health of MonitOps itself.

Platform health30 Sep 2026 · 14:04 ICT
Sources
  • payments-gw · metricsLast sample 10 s agoHealthy
  • crm-sync · logsSilent since 13:48. Shown as unknown, never as healthyUnknown
  • provider-status · feed42 min old. Marked stale wherever it is citedStale
Forwarding queues
  • pagerduty0 queuedDelivering
  • servicenow214 queued · oldest 3 min · retryingBacklog
  • slack0 queued · not held up by servicenowDelivering
MonitOps components
  • ingestLag 2 sHealthy
  • investigatorResponding · endpoint as agreedHealthy
Fig. 7 — The console's health panel during INC-20931. servicenow is backed up; pagerduty and slack deliver on their own queues.
In detail

Ingestion gaps, stale sources, integration failures and delivery backlogs appear in the console. MonitOps monitors its own components and shows their health alongside yours. Forwarding to other systems uses persistent queues per destination, so one slow destination does not block the others.

Security questions

Security reviews and questionnaires

We are glad to complete your security questionnaire and walk your reviewers through the architecture. To report a vulnerability or ask a security question, write to us.

security@monitops.com
Deployment and operations in the documentation