Security and Privacy

Profiler security

The Graphsignal Profiler runs as a separate sidecar process alongside your workload and does not require root or any elevated privileges.

Its local /signals endpoint binds to 127.0.0.1 by default — when no listen host is specified, it is not reachable from outside the machine. Binding another host with --listen-host (or GRAPHSIGNAL_LISTEN_HOST) is an explicit opt-in that exposes the endpoint for remote access; it is read-only but unauthenticated, so anything that can reach that address can read the profiling data — restrict access at the network level.

Signals are uploaded only when you set GRAPHSIGNAL_API_KEY, and only to the server it reports to: api.graphsignal.com when you use Graphsignal’s hosted service, or your own instance if you run one. Without the key, no profiling data ever leaves the machine. Remote commands are not possible in any configuration.

Data privacy

Content and sensitive information, such as prompts and completions, are not recorded.

Once per run the profiler asks api.graphsignal.com whether a newer release exists, sending its own version and nothing else; set GRAPHSIGNAL_DISABLE_VERSION_CHECK=1 to turn it off.

If required, please contact us at legal@graphsignal.com for a Data Processing Agreement.