Ridgeline Technologies
Security
Ridgeline Technologies, LLC · Last updated: August 11, 2026
This page describes how our Grafana plugins handle your data and credentials, and how to report a security issue to us.
1. Security model
Our plugins are designed so that we never receive your data. The plugin executes entirely within your own Grafana environment and queries only the systems you configure it to query. No telemetry, metrics, monitored data, or credentials are transmitted to Ridgeline Technologies, and we operate no data collection or processing infrastructure in connection with the plugins.
This is an architectural property, not a policy commitment. There is no channel by which your operational data could reach us.
2. Credential handling
- Credentials you enter are stored in Grafana’s encrypted secrets store
(
secureJsonData), managed and encrypted by your Grafana installation. - Credentials are read only by the plugin’s backend process, which runs inside your environment. They are never returned to the browser or exposed to the frontend.
- We recommend provisioning a dedicated, least-privilege, read-only account or API token for the plugin. Our documentation specifies the minimum role required.
3. Network and data access
- All API calls the plugins make to your infrastructure are read-only. The plugins issue no create, update, or delete operations.
- TLS certificate verification is enabled by default. It can be disabled only by explicit opt-in on the data source configuration page, for environments still using a self-signed certificate, and the configuration page states the tradeoff.
- Response sizes are bounded, so a misconfigured or hostile endpoint cannot exhaust memory in your Grafana backend.
4. Distribution integrity
Our plugins are distributed through the Grafana Labs Marketplace and are signed under Grafana’s plugin signing process. Grafana verifies the signature before loading a plugin. Install our plugins only through the Marketplace or another channel we have published.
5. Reporting a vulnerability
If you believe you have found a security vulnerability in one of our plugins, please email [email protected].
Where possible, please include:
- the affected plugin and version;
- a description of the issue and its impact;
- steps to reproduce, or a proof of concept.
We will acknowledge your report within five business days and will keep you informed as we investigate. We ask that you give us a reasonable opportunity to remediate before public disclosure. We will not pursue legal action against researchers who report findings in good faith, avoid privacy violations and service degradation, and do not access or modify data beyond what is necessary to demonstrate the issue.
We do not currently operate a paid bug bounty program.
6. Certifications
Ridgeline Technologies, LLC holds no third-party security certifications at this time. We do not claim SOC 2, ISO 27001, PCI DSS, or HIPAA compliance. We would rather state this plainly than imply coverage we do not have.
7. Subprocessors
The third parties we rely on to operate our business are listed on our Subprocessors page. None of them receive data from your Grafana environment.
Contact
Ridgeline Technologies, LLC
[email protected]