Skip to main content

Data privacy

Ghostpsy is designed to collect the minimum data needed for a security audit. This page explains what data is stored and how it is handled.

What is stored​

  • Ingest payload — the JSON data collected by the agent (system configuration, service versions, network listeners)
  • Scan report — the AI-generated analysis (findings, risks, remediation steps)
  • Account data — email, organization name, hashed password

What is NOT stored​

  • Application data, database contents, or user files
  • Private keys, passwords, or secrets
  • Network traffic or packet captures
  • Full installed package lists (only counts and a small sample)

Data isolation​

Each organization's data is isolated:

  • Machines belong to one organization
  • Users can only see machines from their organization
  • API endpoints verify organization membership on every request
  • Cross-organization access is tested and prevented

Encryption​

  • All API traffic uses HTTPS (TLS 1.2+)
  • Passwords are hashed with bcrypt
  • Ingest tokens are random 128-character strings, consumed on use

Data location​

Data is stored in a PostgreSQL database. The hosting location depends on your deployment (cloud or self-hosted).