User action collection for sensitive customer data

A secure tenant activity data system for a deployment service includes a processor configured to decrypt a set of encrypted stream processed monitoring data, determine and match a transaction identifier, aggregate the stream processed monitoring data with previously decrypted data, re-encrypt the aggregate and provide the encrypted aggregated data.