WatchTower15 was built for engineering teams that are fed up paying enterprise platform prices for features they'll never use, or compromising on where their infrastructure data lives.
Every mainstream monitoring agent installs with elevated privileges because the vendors decided telemetry data was worth the security trade-off. We set out to make that trade-off as small as it can be.
WatchTower15 was designed from first principles: what is the minimum privilege required to collect useful monitoring data? The answer: no root, and two Linux capabilities, CAP_SYS_PTRACE and CAP_DAC_READ_SEARCH, which it uses only for reading, such as per-process statistics, log files and disk usage reports. Its filesystem is read-only, except its own state directory and log.
That same principle guides everything we build. Governance features shouldn't be a paid upgrade. Data residency shouldn't require a phone call to legal. The bill shouldn't require a spreadsheet to understand.
Installed as a service, the agent runs as its own non-root service user with ProtectSystem=strict and two Linux capabilities it uses only for reading. This isn't an option you turn on — every service install runs this way.
Your data lives in the region of your choice — no extra cost, no premium tier. We currently cater to UK, EU, USA, Latam, and SE-Asia regions.
One billing dimension. One number to understand before you sign. No compounding per-seat × per-host × per-feature model.
SSL analysis, DNS anomaly detection, and domain expiry monitoring are part of the platform — not a premium add-on.
The market leaders gate data residency behind premium plans or increased rates. We make it a given option for every customer.
Your data lives in the region of your choice without extra configuration, extra cost, or a separate support tier. We currently cater to UK, EU, USA, Latam, and SE-Asia regions.
GDPR Chapter V transfer restrictions respected by default — we don't cross adequacy decision boundaries without your instruction. No personal data routed outside your chosen region.
Cloudflare provides our edge network: TLS termination and request processing. Full sub-processor list available on request. We will notify you before any new sub-processor that touches customer data is added. DPA available at signing.
The installer needs root once. The service it installs never runs as root, and no setuid binary can raise its privileges.
NoNewPrivileges=yes — the agent and its children can never gain privileges through setuid binariesProtectSystem=strict — the filesystem is read-only except the agent's state directory and log filePrivateTmp=yes — isolated /tmp namespaceCapabilityBoundingSet=CAP_SYS_PTRACE CAP_DAC_READ_SEARCH — it can never hold any other capabilityAmbientCapabilities=CAP_SYS_PTRACE CAP_DAC_READ_SEARCH — used only for reading, such as other processes' statistics, log files and disk usagewt15-server-agent service user/sys/fs/cgroup directlyA standard DPA is available to all customers. We act as a data processor for monitoring data your servers collect. The DPA is available at account sign-up; no negotiation required for the standard form.
WatchTower15 Incorporated processes personal data in accordance with GDPR. We act as a data processor for monitoring data your servers collect, and as a data controller for account and contact information.
Personal data of EU and UK data subjects is not transferred outside the EEA or to countries without an adequacy decision without your explicit instruction and an appropriate transfer mechanism in place.
In the event of a personal data breach, we will notify you within 72 hours of becoming aware — in line with GDPR obligations — so you can meet your own notification timelines.
Whether you want a demo, a pricing quote, a copy of the DPA, or just to understand if WatchTower15 fits your infrastructure — we're happy to talk.
Tell us about your infrastructure and we'll come back with a transparent quote. No auto-renewals, no surprise invoices.
Email sales@watchtower15.comResponse within one business day