What is in a stack trace, and what we do about it.
You are the controller and we are the processor. This page says what that means in practice: what arrives, what is removed before storage, where the rest sits, for how long, and how to have all of it deleted.
What arrives here
An error carries an exception type, a message, a stack of frames, and whatever context the SDK attached: the URL, the HTTP method, headers, the release, the environment, and often the identifier of the logged-in user if you configured that. A breadcrumb trail carries what happened before the failure. A log line carries whatever your application wrote.
Some of that is personal data. Pretending otherwise is the mistake this page exists to avoid, and it is why the defaults below are what they are rather than something you have to switch on.
What is removed before anything is written
A fixed list of keys is stripped from every payload, case-insensitively and at any depth, on every collector: passwords and confirmations, secrets, tokens of every kind, authorisation headers, cookies, session identifiers, CSRF tokens, card numbers, CVV codes, IBANs and private keys. You can add to that list per collector. You cannot remove from it.
The URL stored on an event row is stored without its query string, because a column is not run through the scrubber and a query string is exactly where a session token or an email address ends up. The whole URL stays in the payload, where scrubbing does apply.
Scrubbed on arrival
Before the payload is compressed and before it reaches storage, not afterwards.
Your own additions
Add the field names your application uses. They are applied the same way.
Or store nothing
A collector can be set to keep counts and titles only, discarding every payload on arrival.
Where it sits and for how long
Payloads go to an object storage bucket created for your organisation in an EU region. The database, holding titles, counts and pointers, runs on servers in Germany. Two retention windows are yours to set per collector: how long an event row is kept, and how long its payload is. Your plan caps them; asking for less is always allowed.
Backups of the database are kept for thirty days and then roll off. That window is stated here rather than left vague because it is the honest answer to "is it really gone", and thirty days is what it is.
Rights, and how to exercise them through us
Requests from your users come to you, because you are the controller. We act on your instruction, and the management API is how most of it is done without waiting for us: an event can be deleted, an issue can be deleted with everything under it, and a project can be removed entirely.
For an erasure request that covers everything, ask and we delete the bucket and drop the organisation database. That is a call rather than a sweep, which is the practical advantage of a bucket per organisation.
Questions people actually ask
Do you need a DPA with us?
Yes, and it is published rather than negotiated: you can read it before signing up. On Business it is signed as part of onboarding, and it is available on request below that.
Are there transfers outside the EEA?
Yes, one. Every request reaches us through Cloudflare, a United States company, which terminates the encrypted connection before passing it on. It is used for transport only, and the transfer is covered by the standard contractual clauses. The other sub-processors are in Germany, the Netherlands and Belgium. Alert delivery to Slack or Microsoft Teams leaves as well, which is why it is opt-in per alert rule and named in the agreement.
Can we stop storing payloads entirely?
Yes. Set a collector to discard them and you keep grouped issues, counts, levels and graphs without a single trace being written anywhere.
What do you do in a breach?
Notify you without undue delay and in any event within seventy-two hours of becoming aware, with what we know at that point rather than after the investigation, because your own notification clock starts when ours does.
Fourteen days of Team, without a card.
Sign up with your work address, prove your domain with one DNS record, and paste a DSN. The first stack trace usually arrives before the coffee does.
No card. The trial ends by itself and drops to Free; nothing is charged unless you choose a plan.
