Trust

Security posture for managed Linux monitoring.

Nova is designed around tenant-scoped access, short-lived collector enrollment, explicit feature controls, and a narrow Linux monitoring scope. This page describes the current private-beta posture and where review is still required.

Request security review Read FAQ

Access model: Tenant roles map into Grafana org access through OIDC.
Collector enrollment: One-time installer tokens are revoked, expire, and are marked used after exchange.
Sensitive paths: Known private-key and system credential paths are blocked for file log monitoring.
Beta limit: No public SOC 2, ISO 27001, or penetration-test report is claimed yet.

Tenant isolation and roles

NovaUI creates tenant records, maps each tenant to a Grafana organization, and uses role claims for tenant admin, editor, and viewer access. Tenant-scoped UI views resolve the active tenant before showing collectors, team members, limits, or billing status.

This is an application-level and Grafana-organization isolation model. Prospects with stricter separation requirements should discuss private deployment, network isolation, and data-residency requirements before rollout.

Collector enrollment and credentials

Collectors are enrolled with one-time node tokens. Active tokens are revoked when a new one is generated, tokens expire, and the installer exchange marks a valid token as used.

After enrollment, collectors authenticate with generated credentials for configuration and telemetry routing. NovaUI tracks collector status using check-ins, config polls, and reported Alloy versions.

Installer tokens are bearer secrets and should be treated as sensitive.
Collector credentials are not intended for browser display or logs.
Suspended tenants cannot create new installer tokens.

Telemetry and sensitive data

Nova V1 focuses on Linux host metrics, systemd journal logs, selected file log paths, and optional Docker telemetry. The current file monitor validation blocks absolute paths known to contain private credentials, such as shadow files and common private-key locations.

Customers still control what their applications write to logs. Nova can help with collection defaults, but teams should avoid logging passwords, access tokens, payment data, personal data, or application secrets.

Current limitations

Nova is in private beta. The current site should not be read as a compliance certificate, audit report, or security warranty.

Before production rollout, customers should confirm TLS/proxy configuration, secure cookie behavior, staff account controls, retention policy, incident contacts, and any contractual security requirements.