How we handle your logs
Security teams are right to ask where their logs go. Here is exactly what happens.
Masking before anything else
The lines you paste are processed first by code that runs on our server, before any AI model is involved. It replaces, consistently within your session:
- IPv4 and IPv6 addresses → synthetic private-range addresses
- usernames in
user=,"userName":,DOMAIN\user,user/NAMEand similar forms →user1,user2… - email addresses →
userN@example.com - fully qualified hostnames →
hostN.example.com - MAC addresses and GUIDs → synthetic values
Well-known vendor domains such as amazonaws.com or microsoft.com are kept because they carry meaning the parser needs. Once a value has been masked anywhere, it is also replaced where it appears in free text in the same batch.
What masking cannot catch: single-word hostnames and resource names (FW-HQ-01, RG-PROD-01), and account names inside free text that never appear in a recognisable field. If those matter to you, replace them before pasting.
What the AI model sees
The masked sample lines (at most 20 representative lines per generation), the error text you paste, and the request you type. The model is Claude, provided by Anthropic through their API, under their commercial terms, which do not permit training on API data. The test lines shown back to you are unmasked, because they come from your own paste and never leave your browser except to be shown to you.
What we store
Your account (email), your credit balance and purchase records, and the parsers generated for you: the code, each fix version, the analysis summary and, for extensions, the request you typed. These are saved so you can come back to them from your account page.
Not stored: the log lines you paste. They are processed in memory for the request and discarded. The test lines shown after generation are only kept in your browser for that session. Error messages you paste are not stored with the job; recurring error patterns are reviewed in aggregate, with no customer identification, to improve the generator.
What we do with errors you paste
SIEM error messages contain syntax information, not log content. Recurring patterns become rules that make the first parser better for everyone.
Your part
Paste logs you are allowed to share with a processor, and prefer a small representative sample over a full export. The sample does not need to be large to produce a good parser.