Security

What protects your workspace

NetWatch Cloud handles surveillance-capable data: the connections your hosts open, the processes that opened them, and the names they resolved. That deserves controls that can be checked rather than asserted. Everything below is implemented and testable today.

Identity and access

TOTP multi-factor authentication

Authenticator-app 2FA with single-use time steps, so an observed code cannot be replayed inside its window. Ten single-use recovery codes, stored hashed and shown once. Enabling MFA ends every existing session.

Role-based access control

Four roles — owner, admin, member, viewer. Viewers are strictly read-only; credential issuance, host deletion and capture attestation require admin; ownership transfer, data export and account deletion require owner. Role changes take effect on the next request, not at token expiry.

Revocable sessions

Refresh tokens are opaque secrets stored as hashes, rotated on every use. Replaying a rotated token is treated as theft: the whole chain is revoked and the event is logged. You can list active sessions with their IP and user agent and end any of them, or all of them at once.

Brute-force resistance

Per-IP rate limits on every endpoint that accepts a secret, plus a per-account lockout that a distributed guesser cannot rotate around. Login runs the same work whether or not the address exists, so response timing does not reveal who has an account.

Accountability

Append-only audit log

Sign-ins and failures, MFA changes, API-key issue and revoke, host deletion, member invites and role changes, consent, export and deletion — each with actor, IP and user agent. The table rejects UPDATE and DELETE at the database level, so the log cannot be edited by anything, including us. Exportable as CSV.

Recorded consent

Every user acknowledges the monitoring risk disclosure, acceptable use policy, terms and privacy notice before their account exists. Each acknowledgement stores the document version and a SHA-256 of the exact text shown, so what someone agreed to years ago is answerable from the database. Consent records are append-only and survive account deletion.

Capture is attested per host

Live traffic capture is off by default on every host. Turning it on requires a named admin to attest in writing that they own or are authorized to monitor that specific machine. Capture is metadata-only and always redacted — no payload bodies. Every session and every filter change is recorded in a forensic trail that survives offboarding.

Data

Self-serve export

Owners can export the workspace as JSON: hosts, members, alert rules, API-key metadata, consent records, capture sessions and the audit log.

Deletion with a grace period

Account deletion needs the owner’s password and a typed confirmation, then runs after a grace period so a deletion triggered by a stolen session can be cancelled. Telemetry, hosts and credentials are purged; audit and consent records are retained as security and legal evidence.

Retention you control

Telemetry is deleted on your configured retention schedule. Sessions and expired invitations are pruned automatically.

Credential handling

Passwords are hashed with bcrypt at cost 12. API keys are stored hashed and shown exactly once. Refresh, invitation, reset and recovery secrets are stored as SHA-256 digests, never in plaintext.

What we do not have

Listed because you would find out during procurement anyway, and a vendor who hides these is a vendor whose other claims are worth less.

  • —No SOC 2 or ISO 27001 certification. NetWatch Labs is a one-person company; the controls above are real, the audit paperwork is not there yet.
  • —No SAML or SCIM yet. Authentication is email, password and TOTP.
  • —Data is hosted on Railway (managed Postgres). There is no region-pinning or self-hosted option for NetWatch Cloud today — the open-source agent and the standalone dashboard can be run entirely on your own infrastructure if that is a requirement.
  • —Encryption is TLS in transit and whatever the managed database provides at rest. There is no customer-managed key option.

Reporting a vulnerability

Email admin@netwatchlabs.com with steps to reproduce. You will get a human reply, usually within two working days. Please do not test against other people’s workspaces — create your own free account, and tell us before running anything that could affect availability. We will not pursue legal action for good-faith research that respects those two limits.

See also the monitoring risk disclosure and the privacy notice.