Privacy Policy

This explains what ThreatGuard ("we") collects when you use ThreatGuard, why, who else sees it, and what you can ask us to do with it. We wrote it to match what the software actually does.

What we collect

Your account. Your email address, your password (stored only as a one-way bcrypt hash — we can't read it), your plan, and the time you signed up.

Your servers. For each server you connect: the name you give it, its IP address, hostname, operating system and agent version.

Login activity from your servers. The agent sends the SSH login lines from the server's auth log: the connecting IP address, the username tried, the login method, the time, and the log line itself. It also records, for each SSH connection, the client's version string and key-exchange offer (an "SSH fingerprint"). It never sends passwords (sshd doesn't log them), files, keys or the contents of SSH sessions. Most of these IPs and usernames belong to attackers; some will be you and your users. For port rules, it also counts new incoming connections per IP address and port.

Server health. Every few seconds: CPU, memory, swap, disk and network use, load and uptime, and the name, CPU and memory use of the five busiest programs.

Security settings. A few times a day: the SSH server's settings, which updates are waiting, whether a firewall is on, the names of accounts with root rights, and system hardening settings (such as kernel security options, permissions of files like /etc/shadow, and whether audit logging and time sync run). The agent also lists the ports open on the server and the program that owns each one.

Changes that could be a back door. The names, IDs and login shells of the server's accounts; for each authorized SSH key, its fingerprint, type and comment (often a name or email); and a hash and the path of files such as sudo rules, cron jobs, systemd services and the SSH server's config. Hashes only show that a file changed — the contents of these files are never sent.

Installed software. The name and version of every installed package, the newer version available, and whether that update is a security fix. If the server runs Docker: each container's name, image, state and settings (published ports, the host folders it mounts, the user it runs as, its privileges), and the list of packages inside each image in use. Container environment variables and the files inside containers are never read.

Programs that look like an attack. When a running program looks like a reverse shell, crypto miner, web shell or hidden program, the agent sends its name, program path, full command line, the account it runs as, the program that started it, the address it is connected to and its CPU use. A command line can contain whatever was typed into it, so it may include data you consider private. Other running programs are only looked at on the server and never sent.

Scans of your server. We scan the public IP address your server's agent connects from, from the internet, to see which ports are open. We never scan any other address.

Location of IP addresses. For IPs that attack your servers we look up the approximate country, city and network owner.

Payments. For a Pro upgrade: the amount, the UPI reference (UTR) you enter, the order and payment IDs, and whether it was approved. At checkout you also give a WhatsApp number, to which a one-time sign-in code is sent. We never see your UPI PIN or bank login — you pay in your own UPI app.

In your browser. A sign-in token kept in your browser's local storage so you stay signed in. We use no advertising or analytics cookies and no tracking.

Why we use it

• To run the service: show your servers' activity, detect attacks and threats, find vulnerable software, check security and compliance controls, and apply the blocks and kills you ask for.
• To manage your account and plan, and confirm payments.
• To keep ThreatGuard itself secure — for example, limiting repeated sign-in attempts.
• To contact you about your account or important changes. We send no marketing.

We do not sell your data or use it for advertising.

Who else receives data

• Our hosting provider, whose servers store and run ThreatGuard.
• ip-api.com receives the IP addresses that attack your servers, to return their location. It does not receive your email or anything else about you.
• OSV.dev (run by Google) receives the names and versions of installed packages, to return the known vulnerabilities in them. It does not receive your server's name, IP address or anything about you.
• Amazon Web Services (SES) delivers the emails we send you, so it receives your email address and the content of those emails, such as alerts about your servers.
• api.ipify.org is asked by the install script for your server's public IP address, once, during installation.
• WhatsApp (Meta) delivers the checkout sign-in code to the number you enter.
• Your bank and UPI app process the payment itself under their own terms.
• Authorities, when the law requires us to share data.

How long we keep it

• Account and server data, including everything the agent sends: for as long as your account exists, unless you ask us to delete it sooner.
• Removing a server from the dashboard deletes that server's stored activity.
• Payment records: as long as tax and accounting law requires, even after the account is deleted.

How we protect it

Everything travels over HTTPS. Passwords and API keys are stored hashed. Each account only sees its own servers, and the database is not reachable from the internet. No system is perfectly secure; if a breach affecting your data happens, we will tell you and the authorities as the law requires.

Your rights

Under India's Digital Personal Data Protection Act, 2023 you can ask us to: tell you what data we hold about you; correct it; delete it (and your account); and you can withdraw consent by deleting your account. You can also raise a grievance with us, and, if not resolved, with the Data Protection Board of India. Write to support@odemics.in from your account's email address; we reply within 30 days.

If you connect servers that other people log in to, you are responsible for telling them their login activity is monitored for security, and that the programs they run may be checked for threats.

Changes

If we change this policy, the date at the top changes, and we email you about significant changes. See also our terms and refund policy.

Contact and grievances

ThreatGuard · support@odemics.in