Trust & security

Trust and security by subtraction

PMT’s trust posture comes mainly from what it does not do: no endpoint agent, no remote command execution, no inventory collection, no file inspection, no user activity tracking and no broad telemetry by default. Customers choose the small operational signals they send.

Trust model

PMT is a visibility layer, not a control layer.

no endpoint agent
no remote commands
no inventory collection
project-scoped tokens
small payloads
selected outcomes only

More than data minimisation

PMT supports data minimisation by encouraging small signals rather than broad telemetry.

But GDPR-aligned design also depends on access separation, token control, encryption, operational resilience and clear boundaries.

PMT is not automatically compliant for every use case. Users still need lawful basis, good naming discipline, retention decisions and appropriate organisational controls.

Design choices that support alignment

minimal signal payloads
project separation
scoped send and read tokens
token rotation and revocation
expiry/TTL where appropriate
protected identifiers / deterministic encryption where used
encrypted transport and storage-layer encryption
Cloudflare edge protection
retry and back-off behaviour

Scoped tokens

Use send tokens for signal submission and read tokens for view/query access. Keep them project-specific where possible.

Rotate or revoke exposed tokens. Use expiry or TTL where appropriate for shared or temporary access.

Project separation

Separate customers, branches, sites or use cases into projects where separation matters.

Combined views are read-side convenience, not a collapse of separation.

Protected identifiers

Where identifiers need to be linkable without being plain, protected identifiers and deterministic encryption can reduce exposure while preserving operational usefulness.

Encryption paths

Use encrypted transport for submissions and readback. Use storage-layer encryption where provided by the backing platform and configuration.

Do not treat encryption as a substitute for minimising what is sent.

Edge protection

Cloudflare edge protection helps absorb and filter internet-facing traffic before it reaches application infrastructure.

It is part of defence in depth, not a magic shield.

Back-off on failure

Senders and checks should avoid making failure worse. Retry and back-off behaviour helps reduce noise and avoid hammering a troubled path.

Absence remains information.

What PMT should receive

A PMT signal should be small and intentional.

tkn — where it belongs
stn — source/station/site/device name
sens — short stable signal name
val — selected state or scalar value
tag — optional short grouping label

Use stable, boring names. Keep meaning clear.

What not to send

passwords or API keys
private tokens
raw logs
file contents
customer confidential material
personal data unless there is a clear need and basis
large diagnostic blobs
broad telemetry streams

What PMT does not collect by default

endpoint inventory
user activity
file contents
raw logs
broad performance telemetry
remote shell access
domain-wide credentials

Do not add those things to the signal layer unless there is a specific documented reason and appropriate safeguards.

What PMT does not do

run checks remotely
discover systems
patch or remediate
diagnose causes
guarantee delivery, storage or display of every signal
replace specialist tools
act as a compliance archive
control safety-critical or life-critical systems

Shared responsibility

PMT can support a lower-risk signal model, but users still decide what to send, how to name sources, who receives tokens, and how long signal history should remain useful.

GDPR alignment is not a badge. It is a set of design choices, operating practices and legal responsibilities.

Practical user rules

use project-specific tokens
keep tokens out of public scripts and screenshots
rotate/revoke exposed tokens
use expiry for temporary shared access where appropriate
avoid sensitive names and tags
send outcomes, not raw evidence dumps

Signal format

Review fields, examples and naming rules.

Signal format

Project separation

Keep customers, sites and branches separated at source.

Project separation

API / CLI access

Read stored signal data into your own tools without changing PMT’s role.

API / CLI access

Start with less

Send the smallest useful signal. Keep access scoped. Add only what changes action.

Get your signal