Metrics
CPU, memory, disks, network per service.
Personal data: Usually not personal on their own.
In inping: Raw values 7 days, hourly values 365 days, then deleted automatically.
Data protection in monitoring
GDPR server monitoring: which data is involved and what you have to settle
You can monitor servers in line with data protection law once you know which data monitoring touches: pure metrics such as CPU load usually concern no one person, while IP addresses, logs, account names and session recordings do. For this data you need a lawful basis, a contract under Art. 28 GDPR if you use an external service, and fixed deletion periods.
Information, not legal advice
This page explains the situation in general terms, as of 5 November 2026. It does not replace a review
of your case by your data protection officer or a law firm. You remain responsible for how you use it.
Types of data
Which personal data does monitoring touch?
More than the heading “technical data” suggests. These are the main types of data that can occur in inping, with what actually happens to them.
Hostnames and notes
Hostname, operating system, free-text notes per server.
Personal data: Personal if a name appears in them, such as “laptop-anna”.
In inping: Visible to the team. inping super admins can sign in as a user to help; this is logged and the user is informed by mail. What goes into notes is up to you.
Account names
On Linux, CPU, memory and process count per account, disk and network on request, at most 64 accounts; on Windows only on request.
Personal data: Personal if an account belongs to a human being.
In inping: The accounts come from /etc/passwd and are only measured, with no content. Without root the agent only sees its own account.
Scheduled jobs
Cron, systemd timers and similar: schedule, command, user.
Personal data: Commands can contain names and addresses.
In inping: Whatever looks like a password or token is replaced by *** by the agent, already on the host.
Page texts
Change detection: text of monitored pages, including access-protected ones.
Personal data: Contains whatever is on the page, such as names in a team section.
In inping: Text only, never the HTML. The last 20 versions per page are kept.
Log lines and errors
Only if you set up logging: log sources of the agent or SDKs in your application.
Personal data: Often personal: IP addresses, user IDs, mail addresses.
In inping: Off until you create a source. The agent removes secrets already on the host, and the platform does so again for all sources. IP addresses and IDs are not removed automatically. Retention per project: 7 days on the Free plan, up to 90 days depending on the plan, not in the backups.
Session replays
Recordings of browser sessions, only if you switch them on in the SDK.
Personal data: Show what your users saw and did.
In inping: By default the SDK masks text and input and blocks media. Leave it that way. Same retention as logs, not in the backups.
Contacts for notifications
Name, mail, phone, role of contacts on a project.
Personal data: Clearly personal.
In inping: Every address confirms by double opt-in, every mail has an unsubscribe link. Visible to editors and admins only.
Credentials of checked URLs
Basic auth and custom headers for protected pages.
Personal data: Secrets, often attributable to a person.
In inping: Stored encrypted and shown to nobody. For checking, they go to the project's runners, including the platform's. Use a dedicated check account.
Your inping account
Name, mail, password hash, access logs, sign-in devices.
Personal data: Here inping itself is the controller.
In inping: Access logs with IP address for one to two weeks. Notices about new devices store the IP only truncated (IPv4 /24, IPv6 /48) and delete it after 30 days.
Roles and lawful bases
Who is responsible for what?
For the data of your monitored systems you are the controller and inping is your processor. For your inping account and the platform's access logs, inping itself is responsible.
Possible lawful bases
Art. 32(1)(b) of the GDPR (link in German) requires you to ensure the ongoing availability and resilience of systems. Monitoring serves exactly that. The usual lawful basis is legitimate interest under Art. 6(1)(f); Recital 49 expressly names network and information security, to the extent the processing is strictly necessary and proportionate for it. Record the balancing of interests in writing. If you provide monitoring as a service for clients, the contract can be the basis (Art. 6(1)(b)).
IP addresses and truncated values
In Breyer (C-582/14) (in German), the EU Court of Justice saw dynamic IP addresses as personal data if the website operator has legal means of identifying the person. In its 2025 judgment EDPS v SRB (C-413/23 P) it stressed that for pseudonymised data it also matters who holds them and who can identify the person. So do not assume that a truncated address is automatically anonymous.
Two German rules outside the GDPR
§ 25 TDDDG, the German act on data protection in digital services, requires consent if something is stored on or read from an end device and this is not strictly necessary. That mainly affects browser SDKs and replays. The guidance from the Datenschutzkonferenz, the joint body of the German data protection authorities, explains this. At the workplace, § 87(1) no. 6 BetrVG, the German Works Constitution Act, applies as soon as a system is suited to monitoring employees. All three sources are in German. If you operate elsewhere, check the equivalent rule in your country.
Art. 28 GDPR
What must a DPA contain, and what does the inping DPA say?
Art. 28(3) GDPR prescribes subject matter, duration, nature and purpose, types of data, being bound by instructions, confidentiality, security, sub-processors, assistance, deletion and audit rights. This is how the inping data processing agreement (DPA) handles them.
- Instructions
- Your configuration on the platform is the instruction. inping points it out if an instruction appears to be unlawful.
- Sub-processors
- Hosting provider and mail provider. Changes are announced by mail, with objection for good cause within two weeks.
- Deletion
- When a project, team or account is deleted, the data is deleted, and backups are overwritten after 30 days. Monitoring data can be exported through the API at any time.
- Audit
- Documentation on request, audits with four weeks' notice to a reasonable extent.
- Assistance
- With data subject requests, security and data protection impact assessments. Breaches are reported to you without undue delay.
- Applicable law
- German law. For data processing, the DPA takes precedence over the terms of use.
Read the full text in the data processing agreement, and recipients and periods in the privacy policy. It lists the hosting provider and mail provider as processors but currently names no companies. Ask at office@medienakzent.de for your documentation.
Art. 32 GDPR
Technical and organisational measures (TOMs) at inping
No certificate, just specifics: these are the measures that the DPA and the code back up.
Transport
TLS for all connections of agent, runner and browser. Agent and runner open no port.
Secrets
Access protection and webhook secrets are encrypted in the database. Passwords only as a hash.
Separation
Tenant separation in the database and on every access path. Logs sit in a separate database per project.
Access
Roles Admin, Editor, Viewer. Two-factor sign-in and passkeys, with two-factor mandatory for operators.
Read-only agent
Its own user, the service without capabilities, file system read-only except for its state directory. Only the timer for disk usage has CAP_DAC_READ_SEARCH, reads metadata exclusively and has no network. You set project directories locally; you set log sources in inping, including file paths, and whatever the service user may read is read.
Supply chain
The agent and runner binaries are signed and reproducibly built; an update is only installed after its signature is verified. Docker images are pinned by digest.
Backups
According to the DPA encrypted, nightly, kept for 30 days. Logs, traces and replays are not included.
Deletion
Deletion runs daily. A deleted project takes its log database with it.
Third-country transfers
Schrems II and the Data Privacy Framework: where do things stand in November 2026?
The adequacy decision for the US applies, but it is under pressure. If you use US services today, you should have a fallback.
16 July 2020: Schrems II
The EU Court of Justice declares the Privacy Shield invalid (C-311/18, in German). Standard contractual clauses remain possible but require a case-by-case assessment, see the guidance from the Baden-Württemberg supervisory authority (in German).
10 July 2023: Data Privacy Framework
The Commission adopts the adequacy decision (EU) 2023/1795 (in German). It only covers US organisations certified under the Framework.
3 September 2025: action dismissed, appeal lodged
The EU General Court dismisses the action brought by Philippe Latombe (T-553/23). His appeal of 31 October 2025 (C-703/25 P) (in German) is pending before the EU Court of Justice. As of this page's date, we have not found a judgment on it.
Since 29 June 2026: new doubts
In Trump v. Slaughter, the US Supreme Court holds that FTC members may be freely removed. The civil rights organisation noyb calls on the Commission to repeal the decision and announces a lawsuit. The European Data Protection Board asks the Commission for an assessment. The decision stays in effect until it is repealed or annulled.
What does this mean for your monitoring?
For every US service, check whether the provider is certified, and agree standard contractual clauses as a fallback. It is simpler still not to send personal data to a third country at all. That includes asking about subcontractors. More on location under Server monitoring in the EU.
And for payments through Paddle?
Paid plans run through the reseller Paddle, a UK company that handles payment, invoicing and taxes and has its own privacy policy for this. For the UK there is an adequacy decision renewed in December 2025 until 27 December 2031. Monitoring data does not go to Paddle.
Clearly divided
What inping does and what stays with you
inping
- Data processing agreement under Art. 28 GDPR, publicly available
- Platform on servers in the EU, operator in Konstanz, German law
- Fixed deletion periods in the code, adjustable for logs
- Masking and secret filters by default
- No selling of data
- Notifying you of data breaches without undue delay
Your responsibility
- Lawful basis and record of processing activities
- Reviewing the DPA and its sub-processors
- Informing your users and employees
- Consent where browser SDKs or replays require it
- What your application writes into log lines
- Monitoring only your own or authorised systems
Checklist
Twelve points for privacy-aware server monitoring
Whatever the tool. Go through them before you start and record the results.
- 1 Record the data types: which of the types above actually occur at your end?
- 2 Note the lawful basis per purpose, usually Art. 6(1)(f) GDPR with a documented balancing of interests.
- 3 Add monitoring to your record of processing activities (Art. 30 GDPR).
- 4 Conclude and file the DPA. Ask the provider for its sub-processors and their locations.
- 5 Clarify third-country links: where does data go, on what basis, and what applies if that basis falls away?
- 6 Keep logging lean: only necessary sources, no user IDs in logs, the shortest suitable retention.
- 7 Switch on replays only after review, keep masking on, clarify consent under § 25 TDDDG (the German rule on device access).
- 8 Update the privacy policy of the monitored website and internal notices.
- 9 Involve the works council (employee representation in German companies) if the system can capture employees' behaviour or performance.
- 10 For checks of protected pages, create a dedicated account with least privilege.
- 11 Assign roles in the team: Viewer and Editor only for the projects they need.
- 12 Once a year, review: retention periods, recipients, status of third-country rules.
Frequently asked
Questions about the GDPR and monitoring
Is inping GDPR-compliant?
That cannot be promised across the board, because compliance also depends on how you use the tool. inping offers a DPA under Art. 28 GDPR, runs on servers in the EU and deletes data after fixed periods. The lawful basis, informing the people concerned and the content of your logs remain your responsibility.
Do I need a data processing agreement for server monitoring?
As soon as an external service processes personal data on your behalf, a contract under Art. 28 GDPR is required. In monitoring that happens quickly, for example through logs, account names or contacts for notifications. You will find the inping DPA at /legal/dpa.
Are IP addresses in server logs personal data?
They can be. In 2016, in the Breyer case (C-582/14), the EU Court of Justice ruled that even dynamic IP addresses are personal data for a website operator if it has legal means to identify the person with the help of the access provider. So treat them as personal data in monitoring.
Is the EU-US Data Privacy Framework still valid?
Yes, as of 5 November 2026 the adequacy decision (EU) 2023/1795 is in force. The EU General Court dismissed the Latombe action on 3 September 2025; the appeal C-703/25 P is pending. After the US ruling Trump v. Slaughter of 29 June 2026, noyb is calling for its repeal, and the European Data Protection Board asked the Commission for an assessment. So plan a fallback.
May I use session replays?
Only after review. Replays record what users do. Check the lawful basis and whether the SDK in the browser needs consent under § 25 TDDDG, the German rule on storing and reading data on end devices. In inping, replays are off until you switch them on, and by default the SDK masks text and input.
Does the works council have to agree to server monitoring?
It may. In Germany, § 87(1) no. 6 of the Works Constitution Act (BetrVG) gives the works council a say on technical systems for monitoring employees' behaviour or performance, and according to the case law of the Federal Labour Court, being suited to that purpose is enough. Account names with load or logs with user names can fall under this.
Who sees the payment data at inping?
Payment, invoicing and taxes of the paid plans are handled by the reseller Paddle, a UK company, under its own privacy policy. Paddle receives the billing address and the team name. The Free plan needs no payment details.
Start with clear rules
The agent only reads, and logging stays off until you switch it on. How the monitoring itself works is explained in the guide.