Legal

Service levels and data handling

A plain summary of the commitments that matter operationally. This page describes the contract; where the two differ, the signed agreement governs. Nothing here is legal advice and none of it is a substitute for reading the agreement itself.

Halkon is registered in Warsaw, Poland. Terms version 2026-07-01. Material changes take 90 days’ written notice; clarifications that do not reduce a commitment are published here with a revision date.

1 · Service levels

Two commitments, measured monthly, per region. Availability is measured on ingest because ingest is the part that cannot be retried later from your side once a buffer fills.

Commitment	Starter	Standard	Regional	Measured as
ingest_availability	99.5%	99.9%	99.95%	Correctly formed batches acknowledged, over correctly formed batches offered, per calendar month, per region.
query_availability	99.0%	99.5%	99.9%	Queries returning a result or a deterministic error within their timeout, over queries submitted.
durability	11 nines	11 nines	11 nines	Annual, on acknowledged events. Three copies on separate racks within one region.
p1_response	—	8 h	1 h	Time to a named engineer, not to an automated acknowledgement.
incident_notice	status page	status page	direct, 30 min	From the moment we classify an event as an incident, not from resolution.
breach_notice	72 h	72 h	24 h	From becoming aware of a personal-data breach affecting your account.

Credits

Credits are applied against the following month’s invoice for the affected region and require a claim within 30 days. They are the exclusive remedy for missed availability.

Monthly ingest availability	Credit
≥ target	none
99.0% – target	10%
98.0% – 99.0%	25%
95.0% – 98.0%	50%
< 95.0%	100%

What does not count against availability

Data refused for a client-side reason (any 4xx), load shed after your account exceeded its ceiling and burst allowance, announced maintenance windows that did not refuse data, and failures in a network you operate — including your own proxy. Everything else counts, including our own mistakes during a deployment.

Measured availability, the 90-day distribution and the full incident log are on the status page. The target is deliberately lower than what we measure.

2 · Data residency

An account is bound to one region at creation. Customer data written to that region is stored, indexed, replicated, queried and deleted within that region’s jurisdiction, and is not transferred out of it for any operational purpose.

2.1 · What never leaves

Event content: log bodies, metric samples, trace spans, and every attribute attached to them.
Derived artefacts: indexes, block headers, aggregates, materialised views and caches.
Query results, exports, alert payloads and rendered charts.
Backups, snapshots and anything produced by a restore.
Alert rules, retention policies, dashboards and saved queries.
Diagnostic access by our own engineers, which is performed from inside the region under a time-boxed grant.

2.2 · What does leave, and exactly what it is

Item	Content	Why	Held at
accepted_byte_counters	date, region, signal, integer	Invoice generation. No event content, no attributes, no source identifiers.	Poland
account_identity	account id, contact alias, key hashes	Authentication and contract administration. Keys are stored only as salted hashes.	Poland
contract_records	invoices, orders, correspondence	Company law obligations at the registered office.	Warsaw, Poland

This is the complete list. If we ever need to add a row to it, that is a material change and takes 90 days’ notice.

2.3 · Government and third-party requests

We disclose customer data only where we are legally compelled, and only to the extent compelled. Where we are permitted to notify you, we do so before disclosure and in time for you to seek relief. Where we are prohibited from notifying you, we challenge the prohibition where there are grounds to. We publish the number of requests received and complied with, per jurisdiction, in the quarterly service report.

What data residency does not do

Pinning data to a jurisdiction constrains which authority can compel disclosure. It does not make data unreachable, it does not encrypt it against us, and it does not protect against a lawful order in the jurisdiction you chose. Choose the jurisdiction on that basis, not on the assumption that any region is beyond reach.

3 · Processing and sub-processors

For data-protection purposes you are the controller and Halkon is the processor. We process telemetry only to provide the service: accept it, store it, index it, return it to you, evaluate your alert rules against it, and delete it when your policy says to.

roleprocessor — you are the controller

purpose_limitationservice provision only

training_or_analysisnever — your content is not used to improve anything

profilingnone

sub_processor_notice30 days, with a right to object

audit_rightsannual, on 30 days’ notice

dpaavailable unsigned on request

Sub-processors

Categories rather than names on this page; the current named list is in the DPA and is versioned.
Category	Touches customer data	Region scope	Note
colocation and hardware	at rest	per region	Physical custody only. Disks are encrypted; keys are held by us, in-region.
network transit	in transit	per region	TLS 1.3 end to end. Transit providers see ciphertext and endpoint names.
outbound email	alert content	per region	Only what your own alert annotations put in the message. Use webhooks to avoid this entirely.
billing and accounting	no	Poland	Sees byte counters and invoices, never telemetry.
identity for the console	no	per region	Authentication only. Optional — accounts may use keys alone.

4 · Security practices

Technical

TLS 1.3 on every ingest, query and management path. TLS 1.2 remains on syslog port 6514 until 2026-12-01.
Encryption at rest on every storage volume, with keys held in-region.
Keys stored as salted hashes; plaintext exists only at creation and only in the response.
Ingest keys cannot read. Query keys cannot write. Admin keys cannot read event content.
Agent redaction runs on your host, before compression and before transmission.
Internal access to a region’s data plane requires a time-boxed grant, is logged, and is reported to the account on request.

Organisational

Independent penetration test annually; summary available to Standard and Regional accounts.
Vulnerability disclosure at security@halkon.sbs, acknowledged within 24 hours, no legal threat for good-faith research.
Change control on every production deployment, with a named approver who is not the author.
Background checks and confidentiality obligations for anyone with data-plane access.
Incident response rehearsed quarterly, including a full region-loss exercise.
No customer telemetry in our own monitoring, ever. We monitor the service with counters, not with your content.

What we do not claim

We hold no certification we have not been audited for, and this page names none. Ask for the current audit status and you will get a dated answer rather than a badge. If a certification is a hard requirement for you, say so before signing rather than after.

5 · Retention, deletion and export

Action	Effect within	Detail
shorten a retention policy	24 h	Blocks outside the new window are deleted at the next daily sweep. Billing stops at the next daily meter.
delete a stream	24 h	Targeted deletion by an HKQL predicate. Irreversible, and it names the row count before it runs.
close an account	30 d	Data is retained for 30 days for accidental-closure recovery, then deleted. Ask and we will delete immediately instead.
deletion from backups	35 d	In-region snapshots roll off on a 35-day cycle. Nothing is restored selectively from a snapshot to defeat a deletion.
export everything	on demand	Arrow or NDJSON through the ordinary query API at your plan’s concurrency. No egress charge, no export fee, no ticket required.
deletion certificate	5 working days	A signed statement of what was deleted and when, on request, for account closure or a targeted deletion.

Export uses the same API and the same formats as your day-to-day queries, which means the migration path off Halkon is tested continuously by everyone using it. That is deliberate.

6 · Acceptable use

Short, because the service does one thing. Halkon accepts telemetry about systems you operate. It is not a file store, a message queue, a content delivery mechanism or a backup target.

Do not use ingest as general-purpose storage for data that is not telemetry.
Do not send data you have no right to process, including content belonging to third parties.
Do not deliberately exceed a ceiling to test our shedding. Ask and we will arrange a load test window.
Do not use alert webhooks to relay traffic to destinations unrelated to your own alerting.
Do not attempt to access another account’s data, and do report it if you find you can.

We suspend for abuse only after notice, except where continuing would harm other accounts. A suspension never deletes data within its retention window.

Sensitive content in telemetry

Logs routinely contain more than their author intended: session tokens, authorization headers, identifiers, occasionally payload fragments. You remain the controller of all of it.

The agent’s redact filter runs on your host, before anything is transmitted. Using it is the only way to guarantee that a value never reaches our storage — once accepted, a value can be deleted but cannot be un-received.

agent.yamlredact before the wire

filters:
  - redact:
      field: body
      pattern: '(?i)\b(bearer|token|apikey)[=:]\s*\S+'
      replacement: '\1=[redacted]'
  - drop_attribute: [http.request.header.cookie, user.email]

Full filter reference: agent configuration.

7 · Changes and notice periods

Change	Notice	Channel	Your options
Price increase	90 d	written	Terminate without penalty before it takes effect.
Material terms change	90 d	written	Terminate without penalty; export is unmetered.
New sub-processor	30 d	written	Object; if unresolved, terminate without penalty.
Region deprecation	365 d	written	We have never done this. If we must, you get a year and help exporting.
Agent release	—	advisories	Upgrade at your pace; 18 months of support per release.
Wire-format deprecation	365 d	advisories	Both formats accepted throughout the overlap.
Limit increase	immediate	changelog	Nothing to do. We never reduce a documented limit without the 90-day notice.

About this website

This site is a static build. It sets no cookies, loads no third-party resource of any kind, runs no analytics, and makes no network request beyond the documents you are reading. The forms on the pricing and contact pages are intercepted in your browser and transmit nothing. Values on the status page that represent the present moment are computed from your own clock against a published profile; every date, incident and availability figure is a fixed value.

OpenTelemetry, Prometheus, syslog, Grafana and the other formats and tools named across this site are referred to solely to describe what Halkon accepts on the wire or emits. No affiliation, partnership, sponsorship or endorsement is claimed or implied, and no third-party mark is reproduced anywhere on this site.