Skip to content
Osuite Osuite Docs

Security and privacy

Overview

Section titled “Overview”

This page describes how Osuite handles your data: how it is protected in transit, how ingestion is authenticated, how real-user monitoring keeps end-user data private, and where your data lives.

Data in transit

Section titled “Data in transit”

All telemetry reaches Osuite over TLS. SDKs and Collectors send OTLP to your regional ingest endpoint on port 443, over gRPC or HTTP, with TLS enabled:

ingest.<region>.osuite.io:443

Certificate verification is expected to be on — the copy-paste Collector configs in these docs set tls.insecure: false. If a corporate proxy or custom certificate authority intercepts the connection, configure the host’s trust store so the TLS handshake to the ingest endpoint can complete.

Ingest token scoping

Section titled “Ingest token scoping”

Every request that pushes telemetry into Osuite is authenticated with an ingest token carried in the x-osuite-ingest-token header. An ingest token grants write access to telemetry ingestion for your account, in your region — it cannot read data or change settings. Tokens can be rotated and revoked independently in the Osuite UI under Settings → API Keys; see API keys and ingest tokens.

Real-user monitoring privacy

Section titled “Real-user monitoring privacy”

Osuite RUM records real user sessions, and it masks end-user data by default. Text nodes and input values are masked before anything leaves the browser, and you can block or ignore whole regions of the page with privacy classes. See Session replay for the masking behaviour and the privacy classes.

Data residency by region

Section titled “Data residency by region”

Osuite runs in independent regions — US and India. Your data lives in the region where your account was created, and every ingest endpoint is region-specific: telemetry is never routed across regions. For the list of regional endpoints and ports, see the OTLP endpoints reference.

Next steps

Section titled “Next steps”