Security & trust
The iPatch Agent is read-only and outbound-only. It opens no listening ports and it never runs commands sent by our servers. The only instruction it accepts from us is "scan again now".
What it collects
- Hostname, operating system name, version, build and kernel, CPU architecture, uptime, agent version
- Installed OS packages and versions (rpm/dnf, dpkg, apk; on Windows the installed-programs list, OS build and installed updates; on macOS the OS version, /Applications versions and Homebrew packages)
- Language packages (names and versions only) from Python environments and Node.js projects in common system locations
- Names and images of running Docker containers — and, only if you switch it on for that machine, the package list inside them, read with read-only commands
- Listening network ports (port number and whether it is bound to all interfaces) so we can tell if something is exposed to the internet
What it never collects
- File contents, documents or personal files
- Passwords, keys, tokens or other secrets
- Environment variables
- Browsing history, emails, screenshots or keystrokes
- Process command lines
How it is protected
- Agent downloads are verified against a SHA-256 manifest signed with an Ed25519 key held by our server.
- Each machine gets its own credential; we store only a hash of it. Credentials rotate automatically and can be revoked from the dashboard at any time.
- All traffic is HTTPS. Customer data is isolated per organization with database row-level security, which our automated tests try to break on every change.
- Passwords are hashed with Argon2id. Two-factor authentication is required for owners and admins.
- Security questions or a vulnerability to report? Email security@ipatch.net.