Security
How Hawkeye protects your data
Hawkeye is a small company, and this page says plainly what we do rather than what a larger company might say. It is written for the people who trust us with their reading, their drafts, and their point of view. Last reviewed September 16, 2026.
What we hold
Your account email. The sources you monitor and the links you save. Your drafts, published issues, editorial guidelines, and point of view. Newsletters you forward to Hawkeye. Usage logs from the application. We hold nothing about you that you did not put in or ask us to gather.
Where it lives and who can reach it
Hawkeye runs on cloud servers operated by DigitalOcean. Each client has its own separate instance of the monitoring system, not a shared database. Server access is limited to the founder, by cryptographic key only. Password logins to the server are disabled. Contractors who work with Hawkeye have no server access.
Encryption
Every connection to Hawkeye uses HTTPS, with certificates renewed automatically. Administrative access uses SSH. Our connections to the services listed below use TLS.
Keeping the systems current
The servers apply security updates automatically and sit behind a firewall that allows only web and administrative traffic. The application is rebuilt from source on every release. Company email runs through Google, which screens incoming mail for phishing and malicious attachments. Every scheduled job on our systems is watched, and the founder is alerted when one fails.
How AI touches your content
Drafting, summarizing, and analysis run on Anthropic’s API. Under Anthropic’s published API terms, what we send is not used to train its models. Your content is never pasted into a consumer chat product. A person reviews every generated draft before it is published, guided by your editorial guidelines and by claim checks built into the workflow.
Services that process your content
DigitalOcean for hosting. Anthropic for AI drafting and analysis. Cloudflare for reading websites that publish no feed. Resend for sending email. Google for company mail. Adding a service that would handle client content requires the founder’s approval and an update to this page.
Your content is yours
You can export your subscriptions as OPML and your writing as Markdown or HTML at any time. You can ask us to delete your instance and everything in it. Deletion is completed within 30 days and confirmed in writing.
If something goes wrong
We keep a written incident response plan. If we confirm that your data was exposed or lost, we tell you within 72 hours, in plain language: what happened, what was involved, what we did, and what you should do. If you believe you have found a security problem in Hawkeye, write to marshall@marshallk.com. You will hear back within two business days, and we will tell you when it is fixed.