What is stored where

The main rule: code, data and secret values live on your server and in your storage. Nolay keeps only settings and the service information the panel needs to show the state.

In short

Panel

Keeps the account, organization, servers and projects with their settings, version history, events and server metrics. Secrets are kept only as names and a fingerprint of the set. A code archive streams through the panel and is not saved.

Hub

Keeps the list of agents and their tokens, the command queue until delivery, events and metrics. An archive uploaded through the panel stays on the hub for no more than 15 minutes, until the agent takes it. Secret values in the command queue are encrypted.

Your server

A copy of the agent database does not reveal secrets without agent.key.

What support can see

Support sees what the panel keeps: server and project names, settings, statuses and events. Nolay has no access to the server: the agent has a closed list of commands, and an arbitrary command cannot be run on the server through Nolay. Secret values and database contents are not available to support because Nolay does not have them.

Check it yourself

# the agent listens on no inbound ports
ss -tulpn
# the agent does not run as root
ps -o user,pid,cmd -C nolay-agent
# the status shows only secret names
sudo nolay-agent status

Next

Security: the trust model and the agent's rights.