Privacy

The SDK runs inside your app and sends only what's needed to tell whether a provider is healthy. Everything goes to your own collector; nothing is sent anywhere else.

What is recorded

For each outgoing call to a third-party host, one small event:

• the host and HTTP method;
• the endpoint template, built inside your app before anything is queued (/v1/customers/cus_8x2K/cards becomes /v1/customers/:id/cards);
• the status code, duration and outcome (ok, 5xx, timeout, connection error…);
• optionally the value of a provider's request-ID response header (x-request-id and similar, for support tickets) and a correlation ID your code supplies;
• the reason label, when your code marks an answer as expected (consent_required).

For each webhook delivery your app receives from a recognised sender or a declared route: the sender, the route template, the status your app answered, how long it took, and the sender's signed send time when there is one. For a discovered route: the route template, a suggested sender name and a delivery count.

What is never captured

• request or response bodies;
• query strings and fragments;
• headers: no Authorization, cookies or API keys; response headers only for the request-ID value above. For webhooks the SDK looks at header names, and reads only the sender's timestamp and, for discovery, the Host, Content-Type and CloudEvents source and time values;
• raw paths, error messages, stack traces, client IP addresses;
• anything about calls to your own infrastructure: loopback, private networks, cloud metadata, internal names (redis, *.svc, *.internal), telemetry endpoints, hosts you list in internalHosts or hide in the dashboard.

Paths without personal data

Paths are where personal data hides (/v2/people/jane-doe). By default (pathPrivacy: 'strict'):

• IDs become :id: numbers, UUIDs, prefixed IDs (cus_123), card numbers, emails, long tokens;
• a plain word is kept only if it's a known API word (a built-in vocabulary of words real APIs use, with personal names removed); any other word becomes :id;
• a position that sees more than 16 different values becomes :id.

So /v2/people/jane-doe is sent as /v2/people/:id. When a provider's own resource names show as :id, add them as that provider's allowed words in the dashboard, or give the provider explicit routes in init(). The one deliberate exception: a discovered webhook route keeps one plain lower-case word that names the sender (/v1/payco), at most 16 such words per process.

Where data lives

In your collector's Postgres. Raw events are kept 30 days and per-minute rollups 90 days by default (THEIRSIDE_RAW_RETENTION_DAYS, THEIRSIDE_ROLLUP_RETENTION_DAYS). Alerts go only to the channels you configure.

The full, field-by-field description is docs/privacy.md in the Theirside repository, kept in step with the code.