Security and data handling

This page is for engineers implementing GreenSlope. For evaluator-facing company posture, see Security & trust.

Data residency

Customer telemetry and account data are processed in a single EU region, currently europe-west1 (Belgium). There is no US fallback for launch. If a different region blocks your evaluation, email

support [at] greenslope [dot] io.

Retention

GreenSlope keeps launch retention deliberately short.

After retention, data is deleted. Backups follow the same practical retention boundary.

PII handling

Redact sensitive attributes before export using an OpenTelemetry span processor or your existing telemetry collector.

import type { ReadableSpan, SpanProcessor } from "@opentelemetry/sdk-trace-base"
 
class RedactingProcessor implements SpanProcessor {
  constructor(private inner: SpanProcessor) {}
  onStart() {}
  onEnd(span: ReadableSpan) {
    for (const key of Object.keys(span.attributes)) {
      if (key.endsWith(".email") || key.endsWith(".ip")) {
        ;(span.attributes as Record<string, unknown>)[key] = "[redacted]"
      }
    }
    this.inner.onEnd(span)
  }
  forceFlush() {
    return this.inner.forceFlush()
  }
  shutdown() {
    return this.inner.shutdown()
  }
}

Encryption

• In transit: HTTPS/TLS for app, API, and ingest endpoints.
• At rest: cloud-provider managed encryption in the EU processing region.
• Customer-managed keys: not currently available on self-serve plans.

Network allowlist

Services that emit telemetry to GreenSlope must be able to reach:

The GitHub and Slack integrations make outbound calls from GreenSlope to GitHub and Slack. No inbound access to your network is required.

Compliance boundaries

• GDPR / UK-GDPR: GreenSlope acts as a processor for customer telemetry. The DPA and sub-processor list are public Legal Documents.
• SOC 2 / ISO 27001: not yet pursued. We will not claim readiness, in-progress status, or certification without a signed audit engagement.
• HIPAA / BAA: not supported. Do not send PHI to GreenSlope.

Sub-processors

The authoritative list lives at /legal/subprocessors. Changes are communicated by email to affected customers before they take effect.

Security disclosures

If you believe you've found a vulnerability, email

security [at] greenslope [dot] io. We respond within two UK working days.