How we treat the data you hand us.
WatchTower receives process, network and authentication telemetry from every enrolled device in your organisation. That is more about your business than almost any other tool you run, so this page states plainly how it is protected, how we would tell you if that protection failed, and how to report a problem in it.
Reporting a vulnerability
Write to info@nikah-ai.com with as much detail as you can. A machine-readable copy of this policy is at /.well-known/security.txt in the RFC 9116 format.
We acknowledge within five working days and give a substantive answer on severity and remediation within fourteen. If we disagree that something is a vulnerability we will say so, and say why. A fix does not gate on payment, and we do not require a signed NDA to receive a report.
What we ask of you
Do not access or exfiltrate other tenants' data, do not disrupt the service, and do not publish a proof of concept before we have had the fourteen days. Test against your own trial tenant — signing up needs no card. Reports sent to the address above are treated as good-faith authorised testing under the safe-harbour statement in the security.txt file.
What the agent collects, and what it never does
The agent records execution, network-connection and authentication events, plus asset and patch inventory. It is an event reporter. Commands issued from the console are queued and executed by the endpoint itself, and a quarantined file is held rather than uploaded in the clear. Keystroke logging, screen capture and microphone or camera access are not capabilities the agent has, and there is no configuration that gives it them.
Enrolment and unenrolment both appear in your own audit log, which is append-only and hash-chained, so a tenant can see every administrative action taken against their workspace — including ones taken by us.
Isolation between customers
Every row the agent writes is stamped with the organisation it belongs to, and every read path filters on that identifier. Master-admin access, which crosses tenants, exists to support customers: it is a distinct capability from an ordinary administrator, it is denied to anonymous requests before the handler runs, and it is written to the audit chain with the acting identity attached.
Encryption, credentials and secrets
Transport is TLS throughout with HSTS. Sessions are HttpOnly, SameSite=Lax cookies; state-changing requests additionally require a CSRF token, and the Content-Security-Policy carries a per-response nonce, so injected script cannot execute. Agent enrolment is by single-use code with an expiry and a consumption record, and agent-to-server requests are cryptographically signed. Signing secrets are read per request and never baked in.
Passwords are stored hashed with a memory-hard function and are never logged. We do not send credentials by email, and no genuine message from us will ever ask you for a password.
Retention, export and deletion
How long telemetry is kept is set by plan and stated on the pricing page. You can export your own events, findings and audit history from the console at any time, and a subject access request under UK GDPR is self-served at /my-data. On cancellation we delete the workspace on request and confirm it in writing; the timings are in the data processing terms.
Sub-processors, and what we do when we change them
The infrastructure we depend on is listed in the data processing terms with its purpose and location. Where that list changes we tell paying customers before the change takes effect, because a change of sub-processor is a change to the assessment they made when they bought.
How we tell you when something goes wrong
Incidents that affect availability, or that touch the confidentiality of customer data, are published on the public status page, which keeps its history so what we said and when we said it stays on the record. Where a named customer's data was involved we email that customer's administrators as well, rather than expecting them to notice.
Documents that go with this page
- Privacy notice
- Data processing terms and sub-processors
- Data protection impact assessment
- Employer monitoring notice
- Terms of service
- Refunds and cancellation
- Contact
This page describes the service as it runs today. Last reviewed 26 September 2026. WatchTower is a trading name of Nikah AI Limited.
Try it on your own endpoints
Fourteen days, no card, full capability. Remove the agent and your telemetry goes with it.