Privacy Policy

Last updated: 6 November 2026

SOCsimple respects your privacy. This Privacy Policy explains what information we collect, why we collect it, how we use it, and the choices available to you when you visit our website, request access to SOCsimple, or use the SOCsimple service.

1. Who we are

SOCsimple is a detection content management platform for Wazuh environments.

For purposes of this Privacy Policy, "SOCsimple," "we," "us," and "our" refer to the operator of the SOCsimple service, reachable at privacy@socsimple.com.

2. Information we collect

We may collect information you provide directly to us, including:

• your name;
• email address;
• company or organization name;
• information you provide when requesting beta access;
• messages, support requests, feedback, or other communications you send to us;
• account and organization information created when you use SOCsimple.

When you use the service, SOCsimple may also process technical and operational information necessary to provide the product, such as:

• account identifiers and permissions;
• organization and environment configuration;
• connection status and synchronization metadata;
• Wazuh detection content such as rules, decoders, and CDB lists;
• the Wazuh manager configuration (ossec.conf) of each manager and cluster node you connect. Known credential fields, such as keys, passwords, tokens and webhook URLs, are replaced with a placeholder before it is stored; the rest is kept as the manager reports it, including notification email addresses and server names;
• draft, deployment, activity, and change-history records;
• your time zone: the one you choose in your profile, if you choose one, and the time zone your browser reports when you open SOCsimple. We use it to show times to you and to send emails at the right time of day for you;
• service logs, errors, timestamps, browser or device information, and security-related logs, including the IP address you sign in from, which is kept with the sign-in in the audit record;
• error reports the application sends us when something fails, linked to your account.

The exact information processed may depend on the SOCsimple features you use and the Wazuh services you choose to connect.

Your systems

When Systems is turned on for an environment, SOCsimple reads from your Wazuh manager, and from your Wazuh indexer if you have connected one, what it needs to show which systems send you logs, and keeps this:

• the inventory of your Wazuh agents and of the systems seen only through a collector (an agent that forwards logs for systems without one): name, IP address and subnet, operating system, agent version, Wazuh groups and status, and when each was first and last seen;
• for each log source (one system sending one kind of log, such as a Windows event channel, a file or a syslog listener): where it is set up, whether logs are arriving, and, for each day, how many events it sent, their size, how many Wazuh dropped and how many alerts they raised. These are counts. The events themselves are not kept;
• the collection configuration of your agents, meaning each group's agent.conf and each agent's localfile settings, as Wazuh reports them, which can include file paths and server names, and command lines with their secrets masked;
• a history of the changes SOCsimple observes in the above, such as a system's status, groups, operating system, address, name or agent version changing, or a log source starting or stopping, with the old and new values;
• the expectations you record about a system or log source that has stopped sending (waiting on the client, known silent, or paused), each with a reason, an optional note you write, the date, and the name of the member who recorded it.

Agent names, host names and the notes you write can name a person, and the member who records an expectation is named with it.

Client contacts and notes

Your organization can add contact details (name, email and phone) and free-text notes to a client. These can be about people who don't have a SOCsimple account. People with access to that client can see them. We don't use them to contact anyone or for marketing.

Your security events

SOCsimple does not keep a general copy of your security events on its servers. When you connect a Wazuh indexer, SOCsimple reads events from it to measure how your detection content behaves, and keeps only the results of those measurements per rule: counts, rates, and how many distinct sources the events came from. Raw log lines and alert bodies read from the indexer are not written to SOCsimple's database or logs, except in the cases below.

The exceptions are bounded, and we name them so the sentence above can be believed. When a rule's volume concentrates on one source, the name of that busiest source, usually a host name, is kept on the resulting finding for as long as the finding exists. When SOCsimple raises an issue because a deployed suppression or overwrite has stopped holding, it keeps the counts, the time window and the conditions involved, not the alerts themselves. When you paste a log sample to validate a change before deploying it, a short, one-line preview of that sample is kept with the change record as evidence of the check. A longer sample is cut short; the full sample is not kept. When you start a decoder or rule draft from a Log test sample, the sample lines you tested, and example values for the field meanings you confirmed, travel with that draft so it can be re-tested later. They are kept while the draft is open, and move to any draft that replaces it. Discarding or deploying the draft deletes them: the deployed content keeps only what the field meanings were (for example, that a field is a source IP), and the change record keeps the short preview described above.

When you create or edit a rule draft, SOCsimple may copy a few of that rule's recent log lines from your indexer into the draft as samples. They stay with the draft in your environment and you can remove them. Like the Log test sample lines above, they are kept while the draft is open and move to any draft that replaces it. Discarding or deploying the draft deletes them, unless you keep one as a Saved sample (described below); a deploy that ran them keeps only the short preview described above, in its change record and, when the deploy fails, in its audit record.

You can also keep a sample with a rule or decoder, as a Saved sample, so it can be checked again the next time that content changes. Running or testing a sample never keeps it. A sample is kept when you choose to keep it in a draft, or tick it when you deploy (the tick is off by default), and only once that deploy succeeds; discarding the draft drops it. A Saved sample is the full log line, with when the event happened and where it is in your indexer, which can hold values such as user names, addresses and host names. It is kept in the environment it was saved in, and people in that environment with the analyst role or above can read it. Its full text is never copied to another environment, to your Library or into audit records. When you change a Saved sample, a limited number of its earlier versions are kept, with their text, so you can see how it changed. You can delete a Saved sample at any time, and its text is removed from every version; a deploy that already checked it keeps only the short preview described above. Samples you add to a draft without keeping them are deleted when the draft is discarded or deployed, and a change to a Saved sample made in a draft is dropped if the draft is discarded.

The recent Log test runs described in section 12 are kept in your browser tab, including their full sample inputs and results; they are not server-side test history.

3. Wazuh credentials and connected environments

SOCsimple may require credentials or connection information in order to communicate with Wazuh components that you choose to connect.

We use this information only as necessary to provide the requested SOCsimple functionality, maintain the connection, and protect the service.

Wazuh credentials are encrypted at rest and are never returned to your browser: the connection settings show the address and username only. They are used solely to reach the Wazuh components you configured. Rotating the API user on your Wazuh manager withdraws SOCsimple's access at any time. Known credential fields in the manager configuration are replaced with a placeholder when SOCsimple reads it, before anything is stored.

You are responsible for ensuring that you are authorized to connect SOCsimple to the Wazuh environments, infrastructure, and data you configure within the service.

4. How we use information

We may use information we collect to:

• provide, operate, secure, and maintain SOCsimple;
• review and respond to beta access requests;
• create and administer user accounts;
• synchronize and display detection content;
• support change review, deployment, history, and other product functionality;
• provide support and respond to questions;
• detect misuse, fraud, security incidents, or technical problems;
• improve product reliability, usability, and performance;
• communicate important service or beta information;
• comply with applicable legal obligations.

We may also use feedback you provide to improve SOCsimple.

5. Private beta

SOCsimple may be offered as a private or limited-access beta.

When you request access, we store the details you enter, send a confirmation to the email address you give, and check whether that address's domain can receive mail. A member of the SOCsimple team reviews every request by hand.

During the beta period, we may collect additional product feedback, diagnostic information, and usage information to understand how the service performs and where it can be improved.

Beta access does not mean that your information will be used for advertising or sold to advertisers.

6. How we share information

We do not sell your personal information.

We share information only with the service providers that operate parts of SOCsimple for us, and only what each needs:

• Hosting. The application runs on servers we operate, rented from our hosting provider (currently Hetzner). Everything described in section 2 is processed there.
• Database. The application's PostgreSQL database is run for us by our database provider (currently Neon). Everything described in section 2 is stored there.
• Email delivery. Resend delivers invitations, account-recovery links and operator notices and the summaries you choose to receive. It receives the recipient's address and the message, which can name your clients and environments, rules, issues, drafts and files. It never receives Wazuh credentials, the source of your detection content, or your security events.
• Website. Cloudflare serves the public website at www.socsimple.com and, as any web host does, sees the requests for its pages, including the visitor's IP address. It also runs the visit counting described below. It never sees the application or anything you store in it.

Website measurement. The public website at www.socsimple.com uses Cloudflare Web Analytics to count visits. It records the page viewed, the site that linked to it, and the visitor's country, browser and device type. It sets no cookies, does not identify individual visitors, and does not follow you to other sites. The application at app.socsimple.com runs no analytics at all. No advertising or tracking provider receives anything from either, and both serve their own fonts rather than fetching them from a third party. When the application hits an interface error it sends a short report to SOCsimple itself, not to a third party: the kind of error, the page and environment, the time and the application build, and is linked to your account. It does not include your unsaved content. These providers may process information only as necessary to provide services to us and are subject to their own contractual and legal obligations. If we add a provider that handles your information, we will update this list before that provider starts handling it.

We may also disclose information where reasonably necessary to:

• comply with law, regulation, legal process, or governmental request;
• protect the security or integrity of SOCsimple;
• investigate fraud, abuse, or security incidents;
• protect the rights, property, or safety of SOCsimple, our users, or others;
• support a merger, acquisition, financing, reorganization, or sale of all or part of the business, subject to appropriate safeguards.

7. Customer detection content

Detection content and configuration that you provide to SOCsimple remains yours or your organization's, subject to any rights held by third parties.

We use customer content only as necessary to provide, secure, support, and improve the service in accordance with these terms and any separate agreement with you.

SOCsimple staff do not browse customer content. The people who operate SOCsimple access it only when that is needed to provide support you ask for, to investigate or fix a problem with the service, including one your content may be causing, or to keep the service secure. Client contacts and notes are customer content.

We may also run automated checks over stored content to test and improve SOCsimple, for example to find how many rules a new feature would handle differently. We review the results of those checks, not your content.

We do not claim ownership of your Wazuh rules, decoders, CDB lists, or other detection content merely because they are processed by SOCsimple.

We do not use your content to train machine-learning models, and no SOCsimple feature sends your content to a third-party AI service. If that ever changes, this Policy will say so before it does.

8. Data retention

SOCsimple keeps what it stores while your account is open, and for 90 days after it is closed (see below). Your detection content, its history, findings, drafts, deployments and the activity record are kept in full, because a complete record of what changed, when and by whom is part of the service we provide. The audit record behind the activity history cannot be changed or removed through the service once written; issues and change records are kept, and an issue's status and details are updated as the situation changes. Sign-in IP addresses are kept with the audit record so that misuse of an account can be investigated. Apart from the Systems data described below, nothing is deleted on a time basis, except that a sign-in session expires after a period of inactivity and an invitation stops working after a period. Separately, the samples carried on a draft are deleted when that draft is discarded or deployed, and Saved samples are kept until you delete them (section 2). Copies can remain in database backups, including our database provider's, until those backups are deleted.

Systems data (section 2) is kept as follows. The daily counts for each log source are deleted after 90 days, and the monthly totals they add up to are kept after that. The inventory of systems and log sources, the history of observed changes and the expectations you record are kept in full, like the rest of the record. For collection configuration, the current version is kept however old it is, and an earlier version is deleted 90 days after it was last seen.

Client contacts and notes are kept until changed or cleared, or until the client's data is deleted on request. Activity shows who changed them and when, not the values.

Application logs are kept on our servers. They are designed to record identifiers and outcomes, and IP addresses for sign-in and security events, and not credentials, detection content or log samples; an error can occasionally include part of the data being processed. Our servers keep a fixed amount of log history, so older entries are deleted automatically as new ones are written.

We may suspend an account (see the Terms of Service, section 14). While it is suspended, nobody at the account or at its clients can sign in, SOCsimple stops contacting its Wazuh managers and indexers, and outstanding invitations are cancelled. Nothing is deleted: the stored content, history and saved Wazuh connections are kept, and lifting the suspension restores access as it was.

You can ask us to close your account at privacy@socsimple.com; there is no self-service closure yet. When an account is closed, nobody at it or at its clients can sign in, SOCsimple stops contacting its Wazuh managers and indexers, outstanding invitations are cancelled, and the saved connections and credentials are deleted. The rest of the account's data is kept for 90 days, so the account can be restored if it was closed by mistake, and is then due for deletion. You can ask for earlier deletion at privacy@socsimple.com. Copies can remain in database backups until those backups are deleted, and the audit record described above is kept as a record of what happened.

Archiving an environment takes it out of use. SOCsimple stops contacting that environment's Wazuh manager and indexer, and deletes its saved connection and credentials. Archiving is not deletion: the environment's stored content and history remain, read-only, until it is restored or its deletion is requested at privacy@socsimple.com. An archived environment can be restored by reconnecting it with its credentials.

A managed security service provider can archive one of its clients. SOCsimple then stops contacting that client's Wazuh environments and deletes the saved connections, and the client's own members lose access. A connection still in use, or under a hold we have placed, is deleted as soon as that ends. The provider's staff can still read the stored content and history, and the provider can restore the client. Archiving does not delete that content or history, and it does not end by itself. The provider can ask us to delete a client's data at privacy@socsimple.com, subject to the same retention.

SOCsimple staff can also archive or restore a client or an environment, for example when asked to.

9. Security

We use reasonable administrative, technical, and organizational measures designed to protect information processed by SOCsimple.

However, no internet service, software platform, or storage system can be guaranteed to be completely secure.

You are responsible for protecting your account credentials and for using appropriate credentials and permissions when connecting SOCsimple to your environments.

10. International processing

SOCsimple's application and its database are hosted in the United States: the application by our hosting provider, Hetzner, in Ashburn, Virginia, and the database by our database provider, Neon, in the AWS us-east-1 (Northern Virginia) region. Email delivery through Resend is also processed in the United States. If you are located elsewhere, your information is transferred to and processed there. If we move hosting to another region or add a provider that processes information elsewhere, we will update this section before we do.

Where required, we will take appropriate measures relating to international transfers of personal information.

11. Your choices and rights

Depending on where you live and the applicable law, you may have rights regarding your personal information, including rights to request access, correction, deletion, or other restrictions on processing.

You may contact us at privacy@socsimple.com to make a privacy-related request.

We may need to verify your identity before completing certain requests.

If an organization listed you as a contact, ask it first to correct or remove your details. If you can't reach it, contact privacy@socsimple.com.

12. Cookies and similar technologies

SOCsimple sets one cookie: the sign-in session cookie, which is essential to operate the service. The application also uses browser storage. Log test keeps your most recent runs, including full sample inputs and results, in this browser tab for the signed-in user and environment. This history survives a refresh and can survive a browser tab restore. It is cleared when the tab's page session ends, on sign-out, on a new sign-in, or when you choose Clear beside Recent runs. It is not shared with teammates or stored as a server-side test history. Reopening a result does not send the sample again; running it again does. Browser local storage separately keeps interface preferences and, for a limited time, the samples you set aside to test again once a draft is deployed. Those samples are cleared on sign-out and on a new sign-in. Neither the website nor the application sets analytics, advertising or tracking cookies; the website's visit counting (section 6) is cookieless.

If we ever introduce analytics that identify visitors, or similar technologies, we will update this Policy and provide notice or choices where appropriate.

13. Third-party services

SOCsimple may integrate with or link to third-party services, including Wazuh and infrastructure or identity providers.

Their privacy practices are governed by their own terms and privacy policies. SOCsimple is not responsible for independent third-party services that you choose to use.

14. Changes to this Policy

We may update this Privacy Policy as SOCsimple develops.

If we make material changes, we may update the date above and provide additional notice where appropriate.

15. Contact

Questions about this Privacy Policy can be sent to: privacy@socsimple.com