What Opservo collects — and why it’s safe
Exactly what data the agent gathers, what it never touches, and the design choices that keep it from adding attack surface to your servers.
By The Opservo team
Putting an agent on a production server is a trust decision. Here’s exactly what Opservo’s agent does and doesn’t do, so you can make that decision with full information.
What it collects
- System metrics: CPU, memory, disk, load, uptime, network throughput.
- Inventory: running services, Docker containers, detected apps and frameworks, listening ports.
- Posture: SSL expiry, firewall state, exposed database ports, failed-SSH counts, a security score.
- Normalized log patterns — clustered and summarized, never raw lines.
What it never touches
- Your application secrets or .env files — the agent doesn’t read them.
- Raw log contents — lines are normalized into patterns and the raw text is discarded.
- Your customers’ data — it collects infrastructure metadata, not application data.
Why it’s safe by design
The agent is read-only by default and opens no inbound ports — it only makes outbound HTTPS connections, so there’s no new listener to attack. Everything it sends is HMAC-signed, secrets are encrypted at rest, and updates are signed so a compromised server can’t push a bad build. If you enable remote actions, that’s an explicit per-server opt-in, and every command is audited forever. The full picture is on our security page.
And if you’d rather keep everything in-house, the entire platform runs in Docker — you can self-host it on your own infrastructure.