Data handling and trust
What leaves the facility
In a SaaS deployment, the sensor sends discovery results, network flow summaries, alerts, and baseline statistics to the cloud console over gRPC. Raw packet captures are only uploaded when explicitly requested (for example, when you trigger a network capture or an automated response action does). The sensor does not send a full copy of all network traffic to the cloud.
In an on-prem deployment, data stays within the local network. The on-prem console requires outbound internet connectivity only for user authentication against the identity provider.
Encryption in transit
The gRPC connection between the sensor and the console uses TLS. TLS is enabled by default and should not be disabled in production.
Encryption at rest
Sensitive data stored in the database (such as integration credentials and API keys) is encrypted using AES-GCM before being written to disk. The encryption key is configured as an environment variable on the backend services.
Sensor privileges
CAP_NET_RAW capability, which is enough to open the raw sockets it needs for network scanning (ICMP, ARP, SYN scans) and for capturing traffic from the SPAN interface.The sensor does not modify the network or the devices it discovers. Its posture is passive first. Host scanning and vendor queries are the only active operations, and even those are read-only queries using the native protocols of the devices.
Retention
Inventory and security data (resources, findings, vulnerabilities, alerts) are stored in PostgreSQL. Network flow time-series data is stored in a separate time-series database with its own retention policy. The exact retention periods depend on deployment sizing.