Privacy Policy
At Pasax Security, we believe security should never come at the expense of user privacy. We design our architecture—from the raw Go kernel daemon to our central SOC dashboard—around a strict zero-knowledge and minimal data retention philosophy.
We never inspect, store, or transmit your database credentials, API secrets, or customer application payloads.
Telemetry flows outbound only over mutual TLS 1.3. Your Linux nodes keep zero open inbound listening ports.
No third-party analytics pixels, no behavioral profiling, and zero cross-site advertising telemetry.
Scope & Identity
This Privacy Policy applies to the Pasax Security ecosystem, which comprises:
- pasax-sentinel: The open-source Go Linux kernel background daemon deployed on user VPS instances.
- pasax/shield: The Spatie-compliant PHP/Laravel Web Application Firewall (WAF) and honeypot middleware.
- Pasax Cloud SOC Console: The central web-based dashboard and fleet management API located at
https://pasax.is-a.dev.
When you deploy the open-source components in a standalone, self-hosted, or air-gapped environment without pairing to Pasax Cloud, zero data is transmitted to external servers.
Telemetry Collected by Pasax Sentinel Daemon
When a node is connected to Pasax Cloud, pasax-sentinel emits strictly structured, defensive metadata:
| Data Field | Purpose | Transmission |
|---|---|---|
| Attacker Source IP & Port | Triggering nftables sub-0.2ms packet drops and sharing global reputation. | Encrypted mTLS |
| Attack Signature (e.g. SQLi/LFI) | Categorizing malicious HTTP requests intercepted by WAF/honeypot. | Encrypted mTLS |
| FIM File Hash & Permissions | Detecting unauthorized .env file permission drift or webshell creation. | Hash Only (No Content) |
| Node Health (CPU, RAM, Disk) | Monitoring node responsiveness and alerting on daemon crashes or OOM. | Encrypted mTLS |
Pasax Sentinel never reads or transmits database values, customer personal data, PHP session data, or cleartext secret keys from .env files. File Integrity Monitoring hashes paths and checks Linux file permission octals (e.g. enforcing 0600) without dumping file contents.
Account & Dashboard Data
When you create an account on Pasax Cloud SOC:
- Authentication Credentials: Your email address and cryptographically salted password hash (Argon2id/bcrypt). We never store cleartext passwords.
- API Tokens: Node pairing tokens and secret bearer keys are stored in encrypted form using AES-256-GCM.
- Session Cookies: Strictly necessary HTTP-only authentication cookies to maintain your login session. We do not use third-party tracking cookies or advertising cookies.
Data Retention & Deletion
Security telemetry is inherently ephemeral. We apply automated rolling retention windows:
Dropped packet counters and attack logs are retained on a rolling 30 to 90 days schedule, after which they are permanently purged.
De-registering a node permanently removes its pairing token and associated heartbeat logs within 24 hours.
Global Threat Intelligence Sharing
To provide collective fleet immunity, Pasax computes an aggregated reputation score of malicious IP addresses (e.g. repeated brute-force bots and known CVE exploit scanners).
Shared threat indicators are strictly anonymized: no information identifying your company, server domain name, or origin internal network is ever disclosed to other nodes or third parties.
Your Rights (GDPR & Global Regulations)
Under applicable privacy laws (including GDPR and CCPA), you have the right to:
- Request an export of all telemetry associated with your account.
- Request immediate deletion of your account and paired node histories.
- Audit the open-source codebase of
pasax-sentinelandpasax/shieldto verify our compliance claims independently.
Contact & Vulnerability Disclosure
If you have questions regarding this Privacy Policy, wish to exercise data subject rights, or need to disclose a security vulnerability responsibly, please contact our security team: