[FEATURE] Add pup to HIPAA-Eligible Services list

[justinflannery-sdx]

Is your feature request related to a problem?

As an organization operating under a Business Associate Agreement (BAA) with Datadog, we rely on the HIPAA-Eligible Services list to determine which Datadog products we can safely use in environments that may process Protected Health Information (PHI).

While we are thrilled to see several of Datadog's newer AI and extensibility tools, such as Bits Chat, Bits Agent Builder, Bits Investigation, and the Datadog MCP Server, recently added as "Extended Eligible Services," we noticed that Pup CLI is currently missing from the list.

Our engineering team would love to leverage Pup CLI to streamline our workflows directly from the command line. However, because it is not currently covered under the eligible services list, we are restricted from adopting it for workloads that might interact with PHI.

Describe the solution you'd like

Adding the PUP CLI to the list of Extended Eligible Services" for HIPAA-Eligible Services. If there is a roadmap or expected timeline for when Pup CLI might become HIPAA-compliant (or blockers preventing it from being compliant), please let us know so we can plan our internal tooling adoption accordingly.

Describe alternatives you've considered

As a healthcare-technology organization the only alternative I'm aware of is not using the PUP CLI

[justinflannery-sdx]

I wanted to follow up here, we gently pushed back on our DataDog rep after they told us PUP wasn't safe for HIPAA use-cases. Here is the reply we got:

Based on my review, I don't believe a separate HIPAA eligibility determination is applicable for Pup CLI. Pup CLI is a command-line client that provides an interface to interact with existing Datadog products and APIs. It is not a standalone service or product with its own backend, infrastructure, or independent data storage. Any data accessed through Pup CLI (e.g., logs that may contain PHI) is stored and processed by the underlying Datadog product that the user is interacting with, not by Pup CLI itself. From a HIPAA perspective, the compliance scope should therefore remain with the underlying Datadog product or service. If that product is HIPAA eligible, authorized users may access it through supported interfaces, including Pup CLI. The existence of a CLI interface does not, by itself, create a separate product that requires an independent HIPAA eligibility assessment.

Please feel free to close this ticket - if you're feeling extra generous let me know if there is a list of DataDog services out there to cross-compare against the HIPAA-Eligible Services list

[platinummonkey]

I'll try to clarify: It is safe.

Perhaps different wording but because 1) pup does not store any data itself, 2) pup does not have any specially designed APIs itself 3) pup re-uses existing api endpoints and products if any user of pup has access to only eligible HIPAA products then pup will also only have access to the same data.

I will work with the team internally to have it listed in the referenced link and BAA updated. 👍

Related to CATL-77