Who we are
BasePit is run by SymGov Innovations Labs LLP. Questions about this policy, or about your data, go to support_at_symgovlabs.com.
The website basepit.com is covered separately, on the website privacy page.
Your account
- You: your name, your e-mail address, and your password, or the identity Google or Slack confirms if you sign in with them. If you turn on two-step sign-in, the authenticator's setup and your recovery codes.
- An organisation you create: its name, e-mail address and phone number, the people you invite by e-mail, and the role each person has.
- The part of BasePit that runs your fleet keeps no e-mail address. It knows each person by an id, and asks the account service for an address only at the moment it sends a letter.
What your machines send
Each agent sends what BasePit needs to show and run your machines. The full list, with when each part is sent, is on How it works. In short:
- Kept as history: each host's facts (hostname, addresses, operating system) and its measurements every 15 seconds; your apps' state and usage; the result and last 8 KiB of output of each command; monitor check results; container events.
- Held in memory only: the live picture of a Kubernetes cluster, a Proxmox cluster or a RHEL server. A Kubernetes Secret's values never leave the cluster.
- Never kept: your app logs, which are read from the host only while someone views or searches them; host insight (servers, processes, services, host logs), read only when opened; anything typed into or shown by a terminal, a screen or an AI agent session.
What you keep in BasePit
- Your apps and their settings, releases, monitors, alert rules, status pages, playbooks, and the domains and web apps you check in the Toolbox, with their reports.
- Files you upload, such as JARs and saved images, kept in a folder of your organisation's own.
- Secrets: passwords, tokens and keys you give BasePit, sealed under a key that belongs to your organisation alone, never shown again and never written to a log.
- Activity: a record of who did what, and when.
Billing and payments
- Billing details, which you give before your first purchase: the legal name, the address, the country and state, and a GSTIN if you have one. They hold no e-mail address or phone number, and they are never written to a log.
- Payments happen on the payment provider's own page. BasePit never sees your card. It keeps each purchase's pack, amount, currency, status and the provider's reference.
- Tax invoices are made at each purchase, kept exactly as issued, and e-mailed to your organisation's admins.
E-mails we send
The service sends only these:
- sign-up confirmations, password resets and invitations;
- letters about your credits, to your organisation's admins: running low, grace, paused, running again, and a receipt for each payment, with its invoice;
- the result of a Toolbox test you started;
- alert e-mails to the team that owns what fired, if a rule asks for it.
Alerts sent through an e-mail channel you set up go through your own mail server, not ours.
AI
Your organisation can use BasePit's AI, use its own provider and key, or turn AI off.
- BasePit's AI runs on an AI provider BasePit chooses, OpenAI or Anthropic. For playbooks it is sent what you ask and the playbook, never a secret, and no question or answer is kept beyond its draft. For a Toolbox fix it is sent the findings and facts of the checks on the domain or web app you tested.
- Your own provider and key: requests go to your provider, under your agreement with them.
- AI coding agents run on your own hosts, with your own agent's sign-in or keys, and talk to their vendor from your host. BasePit logs nothing of a session, and reads only usage counts from the agents' own logs.
Who else handles your data
We do not sell your data, and we do not share it for advertising. These are the only others who handle it, each for one job:
| Who | For what |
|---|---|
| Cloudflare | Delivers app.basepit.com and carries the connections from your agents and browsers. Cloudflare ends the TLS connection, so it handles the traffic it carries. |
| The payment provider | Takes your payment on its own page, when you buy credits. |
| Google or Slack | Confirms who you are, if you choose to sign in with them. |
| OpenAI or Anthropic | Answers BasePit's AI requests, if your organisation uses BasePit's AI. |
| A messaging provider | Delivers SMS, WhatsApp and call alerts to the numbers you verify, if you use those channels. |
How long we keep it
| What | How long |
|---|---|
| Host and app measurements | 12 hours on an account that has not bought credits or has anything paused; 7 days on an account holding bought credits. |
| Monitor check results | 7 days, or 30 days on an account holding bought credits. |
| A monitor's daily summary | 30 days, or 400 days on an account holding bought credits. |
| Toolbox runs, and a domain's score history | Runs 90 days; the score history 2 years. |
| Automation runs | 90 days. |
| An AI agent session's last screen | 24 hours after the session ends. |
| Tax invoices | Kept as issued. |
Removing a host, an app or a monitor stops new data about it. To close your account or ask us to delete your data, write to support_at_symgovlabs.com.
How we protect it
Every record belongs to one organisation, and another organisation's records are answered as not found. Secrets are sealed per organisation. Machines prove who they are with a secret of their own on every connection. Every action is recorded. The details are on Security.
Your choices
- Export your organisation's Activity as CSV or JSON at any time.
- Change your billing details on the Billing page.
- Turn AI off for your organisation, or use your own provider.
- Remove a host's agent with one command, and revoke the host in the console.
- Ask us what we hold about you, or to correct or delete it, at support_at_symgovlabs.com.
Changes
When the service changes what it keeps or who handles it, we change this policy. The date at the top says when it last changed.