Security & Trust

Data Residency

Your data is hosted on US-based cloud infrastructure with managed PostgreSQL databases. Large trace payloads are stored in Cloudflare R2 object storage. Each environment runs on isolated instances. Third parties that process customer data are listed on the Subprocessors page.

Encryption

All data in transit is encrypted via TLS 1.2+. HSTS is enforced with a 1-year max-age, including subdomains, with preload.

Trace payloads (prompts, completions and other recorded content) and eval cases are encrypted at rest. Log bodies are redacted with your rules before storage but are not encrypted, so log search keeps working.

Stored secrets (webhook keys, integration tokens) are encrypted using Fernet symmetric encryption. Database credentials and API keys are never stored in plaintext.

Tenant Isolation

All data queries are scoped to your organization at the database layer. There is no shared-tenancy data access — your traces, metrics, and logs are invisible to other organizations.

PII Redaction

Redaction happens in two places. The Python and TypeScript SDKs scrub eight classes of sensitive values inside your process, before a payload is sent to Morse, and this is on by default: API keys, JWTs, credit-card numbers (Luhn-validated), email addresses, US and international phone numbers, US Social Security numbers and IP addresses. IP address redaction is off by default because addresses are often legitimate metadata. Matches are replaced with a [REDACTED:<type>] marker.

The ingest API then applies the same patterns again before anything is written to storage. A cross-implementation test feeds one corpus through the Python SDK, the TypeScript SDK and the server and checks that the output is identical, so the three cannot drift apart. Four patterns (API keys, JWTs, credit cards and SSNs) cannot be switched off, including by turning redaction off in the SDK: the server always applies them. Data sent through OpenTelemetry (OTLP) without our SDK is redacted on arrival only, because there is no Morse code running in your process to do it earlier.

You can turn off the optional patterns and add up to 10 custom regular expressions (256 characters each) per organization, and the same options exist in the SDK. Organization settings are currently changed through the API; there is no settings screen for it yet.

Redaction is pattern-based. It will not catch every kind of personal data, such as names or free-text addresses, so add custom patterns for identifiers specific to your data.

Data Flow

1. Your agent runs the Morse SDK (or sends OpenTelemetry data). The SDK redacts in your process.
2. Data travels to the Morse ingest API over TLS.
3. The ingest API re-applies redaction, then stores the result. Large payloads go to object storage; analytics rows go to our analytics store. See Subprocessors for who runs each.
4. Ask Morse, the Anomaly Investigator and quality scoring send redacted trace excerpts to our AI provider (see “We Do Not Train On Your Data” below).

Who Has Access, and Blast Radius

• Other customers: no. Every query is scoped to your organization at the database layer, and a dedicated tenant-isolation test suite covers it.
• Inside your organization: access follows workspace roles. Viewers are read-only. Personal API keys can be created read-only.
• If an environment API key leaks, an attacker can send data to and read from that one environment, and nothing in other environments or organizations. Revoke the key from the dashboard to end that access. A leaked read-only personal key can read but cannot send data in.

Authentication

• API keys are stored as SHA-256 hashes. Environment keys send data and have full access to their environment, with an opt-in scope for prompt retrieval.
• Personal API keys can be created read-only: a read-only key can query data through the query API but is refused by every endpoint that sends data in.
• Dashboard sessions expire after 7 days and can be revoked.
• Rate limiting on all authentication endpoints.

Security Headers

Every response includes hardened security headers: CSP with nonce-based script loading, X-Frame-Options DENY, Referrer-Policy strict-origin-when-cross-origin, and HSTS with preload.

CI/CD Security

Automated security scanning runs in CI on every pull request:

• Bandit — Python static application security testing (SAST).
• detect-secrets — pre-commit hook to prevent accidental credential leaks.
• pip-audit / npm audit — dependency vulnerability scanning.

Data Retention

Configurable retention periods based on your plan tier. Data is soft-deleted with a 24-hour grace period before permanent removal.

See the full Data Retention Policy for tier-specific details and deletion request procedures.

Status and Uptime

Live availability, per-service uptime history, and incident notes are published at status.morsehq.dev. We monitor the marketing site, the dashboard, and the API, and we post incidents there as we work them — including the ones that make us look bad.

We do not currently offer a contractual uptime SLA. The status page is the number, not a promise.

We Do Not Train On Your Data

Morse does not use your telemetry, traces, prompts, or completions to train, fine-tune, or develop any model. Ask Morse, the Anomaly Investigator and quality scoring (which samples spans on every plan, including Free) send only the trace excerpts they need to our AI provider, after the PII redaction configured for your organization has been applied. The provider's API terms bar it from training on API-submitted data.

Subprocessors

Third-party services that process customer data are listed on our Subprocessors page, with what each processes and where. We notify account owners at least 30 days before adding a new one.

Certifications — Where We Actually Stand

We do not hold SOC 2, ISO 27001, or HIPAA attestations today, and we are not going to imply otherwise on a page about trust. What exists is above: the specific controls, the 72-hour breach commitment, and an open-source SDK you can read.

We have not yet had a third-party penetration test. If your procurement process requires a formal attestation or test report today, tell us at [email protected] — it moves our roadmap.

Breach Notification

We commit to notifying affected customers within 72 hours of confirming a data breach, consistent with GDPR Article 33 timelines.

Contact: [email protected]

Vulnerability Disclosure

We welcome responsible security research. See our full Vulnerability Disclosure Policy for scope, safe harbor, and reporting instructions.

Open-Source SDK

Our Python and TypeScript SDKs are open-source (MIT) — inspect the code that runs in your infrastructure before you deploy it. We believe transparency is fundamental to trust in the observability layer.