Trust & security
Trust and security by subtraction
PMT’s trust posture comes mainly from what it does not do: no endpoint agent, no remote command execution, no inventory collection, no file inspection, no user activity tracking and no broad telemetry by default. Customers choose the small operational signals they send.
Trust model
PMT is a visibility layer, not a control layer.
- no endpoint agent
- no remote commands
- no inventory collection
- project-scoped tokens
- small payloads
- selected outcomes only
More than data minimisation
PMT supports data minimisation by encouraging small signals rather than broad telemetry.
But GDPR-aligned design also depends on access separation, token control, encryption, operational resilience and clear boundaries.
PMT is not automatically compliant for every use case. Users still need lawful basis, good naming discipline, retention decisions and appropriate organisational controls.
Design choices that support alignment
- minimal signal payloads
- project separation
- scoped send and read tokens
- token rotation and revocation
- expiry/TTL where appropriate
- protected identifiers / deterministic encryption where used
- encrypted transport and storage-layer encryption
- Cloudflare edge protection
- retry and back-off behaviour
Scoped tokens
Use send tokens for signal submission and read tokens for view/query access. Keep them project-specific where possible.
Rotate or revoke exposed tokens. Use expiry or TTL where appropriate for shared or temporary access.
Project separation
Separate customers, branches, sites or use cases into projects where separation matters.
Combined views are read-side convenience, not a collapse of separation.
Protected identifiers
Where identifiers need to be linkable without being plain, protected identifiers and deterministic encryption can reduce exposure while preserving operational usefulness.
Encryption paths
Use encrypted transport for submissions and readback. Use storage-layer encryption where provided by the backing platform and configuration.
Do not treat encryption as a substitute for minimising what is sent.
Edge protection
Cloudflare edge protection helps absorb and filter internet-facing traffic before it reaches application infrastructure.
It is part of defence in depth, not a magic shield.
Back-off on failure
Senders and checks should avoid making failure worse. Retry and back-off behaviour helps reduce noise and avoid hammering a troubled path.
Absence remains information.
What PMT should receive
A PMT signal should be small and intentional.
tkn— where it belongsstn— source/station/site/device namesens— short stable signal nameval— selected state or scalar valuetag— optional short grouping label
Use stable, boring names. Keep meaning clear.
What not to send
- passwords or API keys
- private tokens
- raw logs
- file contents
- customer confidential material
- personal data unless there is a clear need and basis
- large diagnostic blobs
- broad telemetry streams
What PMT does not collect by default
- endpoint inventory
- user activity
- file contents
- raw logs
- broad performance telemetry
- remote shell access
- domain-wide credentials
Do not add those things to the signal layer unless there is a specific documented reason and appropriate safeguards.
What PMT does not do
- run checks remotely
- discover systems
- patch or remediate
- diagnose causes
- guarantee delivery, storage or display of every signal
- replace specialist tools
- act as a compliance archive
- control safety-critical or life-critical systems
Shared responsibility
PMT can support a lower-risk signal model, but users still decide what to send, how to name sources, who receives tokens, and how long signal history should remain useful.
GDPR alignment is not a badge. It is a set of design choices, operating practices and legal responsibilities.
Practical user rules
- use project-specific tokens
- keep tokens out of public scripts and screenshots
- rotate/revoke exposed tokens
- use expiry for temporary shared access where appropriate
- avoid sensitive names and tags
- send outcomes, not raw evidence dumps
API / CLI access
Read stored signal data into your own tools without changing PMT’s role.
Start with less
Send the smallest useful signal. Keep access scoped. Add only what changes action.