What Subcloak can and can't see

Team Cloud is built so that Subcloak’s servers hold your team’s data without being able to read it, unless an admin turns on automatic approval after SSO (see below). They do need some information to run the service: who is in the team, billing, and when things happen. Two features, monitors and hosted mocks (marked *), run on our servers in readable form. This page lists all of it.

The table

Subcloak can see	Subcloak can’t see
The team’s name; the owner’s, billing managers’ and members’ emails and display names; roles; seat counts; billing state (Polar holds the card)	Team workspaces, rule and mock sets, library sessions and their tags, Findings, comments, agent setups and vault items, or the names of any of them
Each member’s Macs: platform, app version, when last seen, country. A Mac’s name is kept in plain text with its join request; in the team’s member list it’s encrypted	Pair-debugging traffic
Space ids, kinds (workspace, rules and so on), sizes, write times, who wrote each item, and who has which role in each space	What changed, or what a proposal says
Audit events: who, what kind of action, when, from which country, and ids. Never names or content	The names of items in the audit log (admins’ Macs decrypt them)
That someone was @mentioned, asked for a review or assigned, by whom, when, and in which space id	The comment text
SSO: your identity provider’s issuer, each person’s subject id and email. SCIM, for each person: the user name, email address, display name and whether they’re active, plus the identity provider’s own id for them (externalId), which Okta and Entra use to match people. Every other attribute is dropped	—
Monitors*: the request (URL, headers, body, any secret you put in it) and every result	—
Hosted mocks*: the published mock set, request counts, and the requests sent to them as they pass through (not kept)	—
CI tokens: label, which space ids they can read, run counts and sizes	CI recordings (they’re sealed to the team)

A few more details:

• Emails are stored as a keyed hash, to find accounts, and an encrypted copy, used to send email. We do read them to send invitations, notifications and billing email.
• A joining Mac’s name is sent unencrypted with its join request, so admins can see which Mac is asking.
• Network addresses are stored only as salted hashes. Countries come from Cloudflare.
• The team’s name is stored encrypted with Subcloak’s own key, not end-to-end: it appears in console pages and emails.
• Integration secrets (Slack webhook URLs, PagerDuty routing keys, Opsgenie API keys) and OIDC client secrets are stored encrypted with Subcloak’s own key, because our servers use them. They’re write-only in the console.

What other services see

Service	Sees
Cloudflare	Hosts all of Team Cloud and sends its email.
Polar	Billing: the buyer’s email, payment details and tax information, and the team’s name as the billing customer’s name. Never the team’s workspaces, vault or other end-to-end encrypted data.
Your identity provider	Sign-ins to Cloak Proxy and the console, as for any app you connect to it.
Slack, PagerDuty, Opsgenie, webhooks (only if your team sets them up)	The alert content of your monitors.
Cal.com (only if you book an onboarding call)	The booking details you enter.
Your email provider	Invitation and notification emails. They name the team and the person who mentioned or invited you, never comment text, space names or item names (Monitor* alert emails name the monitor and what failed).

How long we keep it

What	Kept
Audit log	365 days
Version history and deleted items	90 days
Restricted spaces’ earlier access lists (who could read them, when)	Until the team is deleted, so every Mac can verify the current one
Notifications	90 days
Monitor results	30 days
CI recordings	30 days, unless someone chooses Keep
Library entries	Until deleted, or the Library retention policy
A removed member’s or withdrawn invitation’s address and name (sealed)	Until the team is deleted, so the console and audit log can still name them
Everything, after the subscription ends	Up to 7 days while a failed payment is retried, then 30 days read-only, then deleted (within a few days of that)
The old keys’ data after Start over	Deleted by hand within 30 days

The limits

• Sizes and timing show activity. The server sees when people sync and roughly how much.
• A compromised server could withhold or delay changes. Macs post signed checkpoints to each other, so they detect it, but they can’t force the server to deliver.
• Removed members keep what they already downloaded. Removal stops new access, not old copies.
• Automatic approval after SSO, if your team turns it on, makes our server part of deciding who joins. See the trade-off.
• Policies marked “on each Mac” can be bypassed by a modified app. See Policies.
• Whoever holds the Team Recovery Kit can read all of the team’s data.

Related

Security modelKeys, signatures and the threat model.

MonitorsWhat a monitor exposes.

Hosted mocksWhat a hosted mock exposes.