Principles
- Detect on the device. Analysis happens where the activity is; only what an investigator needs leaves the device.
- Never move secrets. Passwords, tokens and keys are found on the device and replaced before anything is sent.
- Nothing acts without your signature. Every command, policy and update is signed with your organisation's key and verified by each device.
- Off until you turn it on. Features that involve a third party, such as the AI triage assistant, are disabled by default.
What is collected
| Data | Purpose | Notes |
|---|---|---|
| Security alerts | Investigation and response | Rule, time, program, process chain, target. Command lines have secrets removed. |
| Activity records | Searching past activity | Program starts and stops, selected file changes, network connections. |
| Device health | Coverage and exposure score | OS and agent version, security settings such as firewall and disk encryption. |
| Secret findings | Leak prevention | Type, file path, line and a keyed fingerprint — never the secret. |
Never collected: file contents, documents, e-mails, keystrokes, screenshots, browsing history or page content, camera, microphone or location. Quarantined files stay on the device.
Separation by organisation
Every record belongs to exactly one customer organisation and every query is scoped to it. Console users are granted access per organisation and role (administrator, analyst, auditor); a managed service provider sees only the clients that granted it access. Separation is covered by automated tests on every change.
Signed commands, policies and updates
Each organisation has its own Ed25519 signing key. A device pins that key when it first connects; afterwards it accepts only response commands, prevention policies and agent updates signed with it — for that device, not expired, and never an older policy or a downgrade. Agent updates are additionally checked against the package's SHA-256 before installing, rolled out in stages, and halted automatically after failed installs.
Agent design
- Privilege separation: the component that talks to the network runs unprivileged; the component that acts runs with system rights and only executes verified instructions.
- No kernel extensions: eBPF on Linux, the operating system's event tracing on Windows, Apple's Endpoint Security events on macOS.
- Self-protection: attempts to stop, reconfigure or remove the agent are detected and reported; removal requires a token from the console.
- Safety rails: operating-system programs are never blocked by a hash, exclusions always win, and a device whose agent stops fails open rather than blocking work.
Console access
- Sign-in requires a second factor (authenticator app or passkey) or single sign-on with your identity provider.
- Passwords are stored as salted Argon2 hashes; authenticator secrets and integration keys are stored encrypted.
- Every administrative action is written to an append-only audit log your organisation can export.
- All traffic is encrypted in transit (HTTPS).
Retention
| Where | Data | Kept for |
|---|---|---|
| Console | Alerts, secret findings | 90 days |
| Console | Activity records | 30 days |
| Console | Audit log, account data | While the account exists |
| Device | Alerts / activity records | 90 days / 7 days |
When a customer ends the service, its data is deleted within 30 days unless the law requires otherwise.
Hosting and sub-processors
| Provider | Role | When |
|---|---|---|
| Cloudflare | Network edge and encrypted transport for the console; this website | Always |
| Anthropic | AI triage summaries (redacted incident metadata, under the customer's own Anthropic agreement) | Only if a customer turns it on |
| Slack / Microsoft Teams | Alert notifications | Only if a customer connects them |
The console is currently hosted in Vietnam. See the privacy policy for full details.
Report a vulnerability
If you believe you have found a security issue in Endpoint Shield, please e-mail namcf1988@gmail.com with the details and steps to reproduce. We acknowledge reports within 3 business days, keep you informed while we fix the issue, and ask that you give us reasonable time before any public disclosure. Please do not access other customers' data or disrupt the service while testing.