Security and privacy
A security product should explain what it does with your data.
This page says what leaves your server, what never does, how the agent protects itself and how the account is protected.
01Server data
What the agent sends to the dashboard.
Sends
- Detected events, with the log line that triggered them (up to 4 KiB)
- Health of the agent and each sensor (heartbeat)
- Firewall receipts and reads
- Assessment results: hardening, vulnerable packages, listening ports
- Malware findings: file path and matching rule
Never sends
- File contents, including during malware scans
- Data from your applications or databases
- Anything to the intelligence network without the account owner's opt-in
02Agent
Signed releases, staged updates.
- Signature
- Every release has an ed25519-signed manifest with each file's SHA-256 and size. The installer and the updater refuse anything that doesn't match.
- Stages
- New releases go through a test stage before general availability. The agent is never downgraded by accident.
- Rollback
- If a new release gets into a crash loop, the agent rolls back to the previous one on its own.
- Uninstall
- Removes the agent and only atalince's own state. Your rules and files stay.
03Account
Dashboard access.
- TOTP two-factor login, with recovery codes
- Active sessions you can see and end
- Owner, admin and read-only roles
- Per-organization API tokens
- 30-day audit log
04Infrastructure
Where the data lives.
- Hosting
- In Brazil.
- Backups
- Daily and encrypted, kept for up to 35 days.
- Transport
- HTTPS between the agent and the dashboard. The agent opens no inbound port.
05Privacy
LGPD, no fine print.
- We don't sell personal data or use it for advertising.
- The dashboard only uses necessary cookies. No advertising or analytics cookies.
- This website uses no cookies and no analytics tools.
To exercise your data subject rights, write to [email protected].
06Responsible disclosure
Found a vulnerability?
Write to the address below with steps to reproduce. Please don't disclose it publicly before we've had a chance to fix it, and don't access other people's data while testing.