Privacy

We don't collect personal information

Last updated: October 23, 2026

The short version: no accounts, no cookies and no personal data collected or stored, with two exceptions: what a purchase needs, if you buy remote-agent seats, and Google Ads, if you allow it on the home page — until you do, nothing from Google Ads loads. The page-view and download counts are anonymous, with nothing tying any of them to who made it. A downloaded build sends nothing back to us, and the EasySIEM software you run never phones home to easysiem.com or anywhere else — every byte it handles stays on your own infrastructure.

What this site actually stores

No session and no account, and no cookie unless you allow Google Ads. The page-view count is anonymous, with nothing tying any view to who made it. Downloads are counted the same anonymous way: a click on one of the home page’s download buttons, or on Copy beside an install command that fetches EasySIEM, counts once for that file. Apart from that, and Google Ads if you allow it, nothing on this site tracks clicks, scroll depth or page-to-page journeys. Your answer to the home page’s ad-cookie question is kept in your browser’s local storage for this site, so you’re asked only once.

Google Fonts

This site loads three typefaces (Inter, JetBrains Mono and Archivo Black) from Google Fonts, so your browser makes a direct request to Google's servers to fetch them — meaning Google sees your IP address for that request, the same as it would for any site using Google Fonts. We don't receive or see any of that; it's a direct connection between your browser and Google. See Google's own privacy policy for how they handle it.

Google Ads

We advertise EasySIEM on Google, and the home page can tell Google Ads when one of those ads brought someone here — but only if you allow it. The first time you open the home page, a banner asks; until you choose Allow, nothing from Google Ads loads at all, and Don’t allow keeps it that way.

If you allow it, the home page loads Google’s tag from googletagmanager.com. The tag sets cookies on easysiem.com (their names begin _gcl) that let Google match a visit to the ad that led to it, and it sends Google your visit along with your IP address, your browser’s details and those cookies; Google may also use the visit to show you EasySIEM’s ads elsewhere. We see only Google’s totals, such as how many ad clicks led to a visit, never who you are. Google describes its side in how Google uses information from sites that use its services.

To change your answer, use Ad cookies at the foot of the home page. Don’t allow turns the tag off and deletes the cookies it set on easysiem.com; any Google keeps on its own domains are managed in your Google ad settings.

Standard web server logs

Like effectively every website, the web server hosting easysiem.com keeps its own standard access logs (IP address, requested page, timestamp, user agent) as a normal part of running a web server — that's the hosting platform's own infrastructure, not something EasySIEM adds, accesses, analyzes, or exports. We're not going to claim a web server generates zero logs anywhere in the stack when we don't fully control that layer; what we can say is that nothing in this project reads, aggregates, or uses them for anything.

Buying remote-agent seats

The seat shop is the one place this site handles a purchase, and PayPal does the paying: you pay in PayPal’s own window, and EasySIEM never sees your card or your PayPal login. The page loads PayPal’s checkout from paypal.com, so PayPal sees that request the way it does on any site with PayPal checkout, and its own privacy statement covers what it does with your payment.

To issue your seat key and to answer questions about it later, the EasySIEM relay keeps a record of each purchase: the PayPal order and transaction IDs, the amount, the number of seats, the email address PayPal reports for the payer and, once the key is applied, which EasySIEM server it went to and when its seats end. The key itself is never stored there, only a one-way fingerprint of it. The relay counts checkouts per IP address for an hour, in memory, to stop floods, and logs the address behind a checkout collected with the wrong secret or a seat key that matches no sale.

Your browser keeps its own copy of each checkout and key, in this site’s local storage, so you can come back for a key you didn’t copy. It stays until you remove it from the shop’s Your seat keys list or clear this site’s data.

The EasySIEM software itself

This is the part that actually matters most for a security tool: the agents, ingest-api, and detect-engine you install never send what they collect to the easysiem.com website or any third party. Everything they collect — Windows Event Log / Sysmon / auditd / journald data, Sigma detection alerts, agent heartbeats — goes to the OpenSearch instance you point them at, which you run, on infrastructure you control. An agent you enrolled to report from outside your network sends it through the EasySIEM relay (relay.easysiem.com) instead, sealed for your server so the relay cannot read it; the relay only passes it on. There’s no built-in telemetry or license-phone-home of any kind.

OpenSearch's own telemetry feature ships off by default (confirmed via a running instance's own cluster settings) — nothing here turns it on.
The release check. Once a day, and whenever you click Check now, the EasySIEM Console downloads one small file from this site, easysiem.com/latest.json, to show on its Server Health page whether a newer release is out. The request carries no account, no identifier, no version number and nothing from your installation; like any page load here, the web server’s log records the address it came from (see Standard web server logs above). It is on unless you turn it off — with the switch on Server Health, or "release_check": false in the Console’s config.json — and then the Console never contacts this site.
Software updates aren't automatic — the release check only tells you a new one is out. Installing it is your click: download the installer yourself, or press Update now on a Windows server’s Server Health page, which downloads it from this site and runs it only if its checksum matches the release list and it carries the same publisher’s signature as the software already installed.
The Android agent. The EasySIEM Agent app sends what it collects on a phone — its apps and settings, and, if you switch them on, app launches, permission use and DNS lookups — only to your own EasySIEM server: directly while the phone is on your network, or, if you enrolled it to report away from home, through the EasySIEM relay (relay.easysiem.com), which forwards it to your server sealed, so the relay cannot read it. Nothing the phone collects goes to the easysiem.com website.

Changes to this page

If this ever changes — say, a future feature that genuinely needs to talk to an external service — it'll be reflected here first, with the "last updated" date above moved forward.

October 2, 2026: added the Console’s daily release check, described under The EasySIEM software itself — on unless you turn it off — and its Update now button, which downloads an installer only when you press it.

October 6, 2026: added Google Ads on the home page, which loads only if you allow it.

October 6, 2026: downloads are counted, anonymously, the way page views are.

October 23, 2026: added the Android agent, which sends a phone’s data only to your own EasySIEM server, directly or sealed through the EasySIEM relay.

Questions

tyson@easysiem.com.