Security & privacy
Your keep.
Your boundaries.
A local agent does the reading. Useful results help you act. Here is what that means for each watcher, including the exceptions.
What leaves your networkShared principles
Observation starts inside your walls.
- 01Local collection
- The agent or SDK runs next to the data, host, or app it watches. Processing starts on your infrastructure.
- 02Results over raw content
- Connected deployments report labels, telemetry, inventory, and redacted aggregates. Source files, full logs, and code stay local, subject to the Classify assist exception below.
- 03Read-only by default
- The watchers observe and report. You review the evidence and make changes through your own systems.
- 04Plain-language explanations
- Findings give you context for the next step. A security signal is a reason to investigate, rather than proof of a compromise.
- 05Honest coverage
- Permissions, sampling, and collection limits affect visibility. Unknown evidence stays unknown. An empty report is not a guarantee that everything is safe.
- 06For small teams, too
- Built for small businesses, homelabs, and builders. You should be able to understand what a watcher sees and what it sends.
The processing boundary
What leaves your network.
“Results” can include identifying metadata. Use this table to understand each product’s boundary before you connect it.
Scroll the table horizontally to see every column.
| Product | What is sent | What stays local / limits |
|---|---|---|
| Classify Connected scans | Labels, counts, confidence, file locations, and normalized sharing classes, counts, and timestamps. | File contents, matched values, source credentials, raw permission lists, recipient addresses, and sharing URLs do not return to the console. Optional masked-snippet assist is an exception described below. |
| Classify Test Drive | Sample file copies you explicitly upload, plus your email and declared relative filenames. Results contain label counts, filenames, labels, and risk. | This is an upload service. A lifecycle worker deletes raw uploads after terminal scan outcomes or incomplete-slot expiry; completed uploads can stay queued while the agent is offline. Current limits and retention are shown in Test Drive. |
| Stack Snack | Host resource telemetry, bounded inventory and evidence. This can include account names, process metadata, file paths and hashes, listener or connection endpoints, and supported container identity and metadata. | Full logs, file contents, command argument values, and environment values are not transmitted. Some command-line patterns are matched locally; only indicator names are sent. Coverage depends on host privileges and collection scope. |
| PinHaul Early access | Python/platform facts, script basename, hashed machine ID, loaded package versions, package/advisory findings, and redacted per-pattern log aggregates. | Full logs, code, environment variables, full paths from the SDK, and hostname stay local. The container agent uses Docker socket access; review the host access you grant. Fix-Radar is feature-gated. |
Permissions & expectations
Keep control of the next step.
Observation is useful when you can understand its boundaries.
- Can a watcher fix things automatically?
- Read-only observation is the default. Classify does not change source permissions or delete files. Stack Snack’s documented observation scope excludes arbitrary remote commands and automated cleanup. You investigate and make changes through your own process.
- What does read-only mean for host access?
- Reading a host still needs permissions. Stack Snack coverage depends on the service profile and visible process metadata. PinHaul’s container agent mounts the Docker socket; a read-only mount does not turn that socket into a limited-permission API. Review access before deploying.
- Can findings prove a whole system is safe?
- No. Classify scans can be sampled, skipped, or partially parsed. Stack Snack uses bounded snapshots that can miss short-lived activity. Inspect coverage and evidence dates; do not treat missing observations as proof of safety.
- Where can I read Classify’s details?
- The Classify security page covers product-specific processing. Its connector documentation describes source permissions and coverage limits.
Responsible disclosure
Found a security issue?
Email security@myrikeep.com with the affected product, what you observed, and steps to reproduce it. Keep credentials and sensitive content out of the initial message.
Contact securityA watcher for your corner of the world
Find your watcher.
Start with your data, your Linux hosts, or your running app. Each has a watcher with a clear job.