What we monitor
OneClickClaw monitors server activity for security and compliance purposes. The categories we observe are:
- SSH access events: when SSH is turned on or off, when a key is added or removed, and when a key was last used.
- Network connection metadata, including destination IP addresses and ports (no packet contents).
- Listening ports, including the port number and the name of the process listening on it.
- An automatic check for crypto mining. At least once an hour, and more often for a server built in the last few hours or one whose processor is busy, an automatic check looks inside your server. It reads the list of running programs with their command lines, their network connections, the program files of the busiest programs, files named like known mining programs (and whether they contain mining pool addresses), and a few system settings that mining programs change. On Hermes Agent servers it also reads the commands the agent itself ran, and keeps only the ones that name a mining pool. It never reads your chats or your documents.
- Message counts per channel, meaning how many messages your agent received and replied to and when the most recent one was. Never who sent them, and never their content. These counts come from OpenClaw's own diagnostics exporter, whose published policy excludes message text, chat identifiers, and session identifiers. On Hermes servers, the same two numbers and the time of the latest message are read from the agent's own history file on your server, with a read-only query that counts rows and never opens a message. We use them to tell whether an agent is actually being used, so a setup that is quietly not working can be spotted and fixed.
What we do not monitor
We do not read your business data, your customer conversations, your AI provider responses, or your documents. Beyond the checks listed above and the automatic health checks and repairs that keep your agent running, we look inside your server only when we investigate an alert, when you ask our support for help, or to answer a valid legal request.
Your AI key stays in your agent's configuration on your server and is used by your agent, on OpenClaw and Hermes Agent alike. See API Key Security for details.
Why we monitor
Monitoring lets us:
- Detect outbound abuse such as DDoS-shaped traffic or port scans.
- Detect compromised servers (malware, cryptominers, botnet activity).
- Respond to legal notices (DMCA, abuse complaints) with evidence and a clear timeline.
- Honour our partnership obligations to Webdock, who provides the underlying infrastructure.
For the same reason, a free trial started from a hosting, VPN or Tor network may be held for a manual review before its server is built. To decide this, we look up which network the sign-up address belongs to in public network directories.
The legal basis under GDPR Article 6(1)(f) is "legitimate interest": keeping the platform safe for all customers and meeting our contractual obligations to our infrastructure partner.
How long monitoring data is kept
Monitoring data is retained for up to 90 days, then deleted automatically. The only exception is when a record is part of an active investigation or legal proceeding, in which case it is kept for as long as legally required.
Your rights over monitoring data
Under GDPR you have the right to access, correct, and request deletion of personal data we hold about you, including monitoring data. To exercise these rights, email info@oneclickclaw.io. See GDPR Compliance for the full process.