Data and privacy
What Bugtail stores, where, for how long, and what never gets stored at all.
Where your data is
Everything is hosted in the European Union. The companies involved are listed on the sub-processors page, and the data processing agreement covers how we handle your data.
Each event is kept in two parts:
- The summary: title, level, count, timestamps, release and environment. This is what lists, counts and charts are made of.
- The payload: the stack trace, the request, the breadcrumbs, and the span tree of a kept trace. Payloads are stored compressed in a storage bucket that belongs to your organisation alone.
Your own bucket
You can keep payloads in a bucket in your own account instead. We then hold the summaries, and you hold the contents.
- Under Settings > Storage buckets, add the bucket: its name, region and credentials, plus an endpoint for S3-compatible services other than Amazon S3, such as Cloudflare R2 or MinIO. Give it a key that can write, read and delete in that bucket and nowhere else.
- Use Test bucket to check that the credentials work.
- On the collector, under Payload storage, choose the bucket.
The secret key is stored encrypted and never shown again. Removing a bucket from Bugtail does not delete anything in it.
To keep no payloads at all, choose Do not store payloads on the collector. Only the summaries are kept, and stack traces are discarded on arrival.
Scrubbing
Sensitive values are removed before anything is written. Passwords, secrets, tokens, API keys, cookies, sessions, authorization headers and card numbers are always removed, at any depth and regardless of upper or lower case.
Add your own keys under Extra scrubbing on the collector, one per line. The built-in keys cannot be switched off.
The page address shown on an event is stored without its query string, because that is where tokens and email addresses tend to end up. The full address stays in the scrubbed payload.
Retention
Two settings on each collector decide how long data is kept:
| Setting | Covers |
|---|---|
| Keep payloads for | Stack traces, request data, breadcrumbs and the span trees of kept traces. |
| Keep events for | Individual events, log lines and the list of kept traces. |
They are separate because the useful values usually differ: two weeks of stack traces and a year of events is a normal choice. Issue counts and charts outlive both settings.
When a payload has been removed, the issue page says so and still shows the summary of the event.