Privacy Policy
sudosudo hosts machines for AI agents and watches servers with an autonomous triage agent. Doing that means holding your account details, the configuration of the machines you connect and the metrics and logs they send. This page says exactly what is stored, who else processes it and how to remove it. Last updated 2026-10-12.
Who we are
sudosudo (sudosudo.dev) is operated from Chile. Contact: alerts@sudosudo.dev. "We" means the sudosudo service; "you" means the account holder and the members of your organisation.
What we store
Account
Your email address, the organisations you belong to and your role in them, pending invitations, and the sessions of your signed-in browsers. We do not use passwords: you sign in with a one-time email link or through Notlogin. Single-use link tokens expire after 15 minutes.
Servers you guard (targets)
Host name or address, SSH connection settings, the alert rules and command allowlist you configure, the metrics your push agent sends, the alerts raised, the triage reports the agent writes and an audit log of every command it ran on your server. Commands are limited to the allowlist you approve.
Hosted machines
For machines we run for you: the template, size, region, state and the identifiers of the underlying cloud instance. What you or your agents put inside a machine is your content; we do not inspect it except to keep the service running or when the law requires it.
Keys you give us
Cloud keys and LLM provider keys you add ("bring your own") are stored encrypted at rest and are used only to perform the actions you request. API tokens you create are stored as hashes.
Technical data
IP addresses and request metadata in server logs, kept for security and rate limiting. Feedback you send through the site, with the email address if you add one.
Analytics and cookies
We use a session cookie to keep you signed in, a language cookie (ss_lang) and a cookie
that remembers your consent choice. Google Analytics 4 is loaded with Google Consent Mode v2: analytics
storage stays denied until you accept in the cookie banner, and advertising signals are
always denied. You can change your choice at any time with "Cookie settings" in the footer.
Who processes your data
- Google Cloud — hosts the control plane (United States).
- Amazon Web Services — runs hosted machines and microVMs, in the region you choose.
- LLM providers (for example Moonshot Kimi, Anthropic, OpenAI or the one whose key you bring) — receive the alert context and command output the triage agent needs to investigate.
- Resend and apumail — deliver sign-in links, alerts and reports by email.
- Notlogin — only if you choose "Sign in with Notlogin".
- Google Analytics — only with your consent.
We do not sell personal data and do not use it for advertising.
Why we process it
To provide the service you signed up for (contract), to keep it secure and prevent abuse (legitimate interest), to measure site usage (consent) and to meet legal obligations.
How long we keep it
Account and configuration data while your account is active. Metrics and alerts are pruned on a rolling basis; audit logs and triage reports are kept while the target exists. When you delete a target or a hosted machine, its data is removed; when you close your account, we delete your data within 30 days, except what we must keep by law.
Your rights
You can ask for a copy of your data, correct it, delete it, or object to a processing purpose by writing to alerts@sudosudo.dev. We answer within 30 days. You can also complain to your data protection authority.
Security
Traffic is encrypted with TLS, keys are encrypted at rest, hosted machines are outbound-only and allowlisted, and every agent action is audited. No system is perfectly secure; if a breach affects you, we will tell you without undue delay.
Changes
We will update this page when our practices change and note the date above. Significant changes are announced by email to account holders.