Privacy

Privacy is a core design principle of Panguard Threat Cloud. All threat data is anonymized before leaving your machine, zero telemetry is collected, and the entire system can operate fully offline with a single configuration flag.

Anonymization

IP Address Masking

All IP addresses are /16-anonymized before submission. The last two octets are zeroed:

Original IP	Anonymized IP
`192.168.1.50`	`192.168.0.0`
`10.0.42.100`	`10.0.0.0`
`203.0.113.50`	`203.0.0.0`

This preserves network-level information needed for threat intelligence while making it impossible to identify specific hosts.

What Is Shared

Data	Shared	Anonymization
Attacker source IP	Yes	/16 masked (last two octets zeroed)
Attack type and technique	Yes	Already generic, no anonymization needed
MITRE ATT&CK IDs	Yes	Public taxonomy, no anonymization needed
Confidence score	Yes	No anonymization needed
File hashes (malware)	Yes	Hash only, no file content
Timestamps	Yes	Rounded to nearest hour
Tags and classification	Yes	Already generic

What Is Never Shared

Data	Status
Your machine’s IP address	Never transmitted
Hostnames or machine IDs	Never transmitted
Internal IP addresses	Never transmitted
File contents	Never transmitted
Log entries or raw events	Never transmitted
User credentials	Never transmitted
Configuration details	Never transmitted
Scan results	Never transmitted
Usernames or account names	Never transmitted

Zero Telemetry

Panguard collects zero telemetry about your usage:

No usage analytics
No crash reports sent externally
No feature tracking
No license phone-home beyond initial activation
No third-party analytics SDKs
No browser fingerprinting
No session recording

Data Retention

Setting	Default	Description
IoC retention	90 days	Indicators older than 90 days are automatically purged
Submission logs	Local only	Kept on your machine, never uploaded
Feed cache	Refreshed every hour	Local cache of external feed data

Opt-Out (Offline Mode)

Threat Cloud sharing can be disabled entirely for air-gapped or privacy-sensitive environments:

# Disable Threat Cloud in Guard
panguard guard config --threat-cloud disabled

# Or set via environment variable
export PANGUARD_THREAT_CLOUD=disabled

When disabled:

No data is submitted to any Threat Cloud instance (public or private)
Guard continues to function with local detection only (ATR rules, baseline)
Threat intelligence lookups use only the last-synced local feed cache
No network connections are made to Threat Cloud endpoints
All other features remain fully operational

Offline mode reduces detection capability since you lose access to collective threat intelligence. Consider running a private Threat Cloud instance within your network as a middle ground between full sharing and complete isolation.

Audit Logging

All data submissions to Threat Cloud are logged locally for audit purposes:

# View submission log
cat ~/.panguard/threat-cloud/submissions.log

Each log entry records:

Field	Description
`timestamp`	When the submission was made
`data`	The exact anonymized data that was sent
`endpoint`	Threat Cloud URL that received the data
`status`	HTTP response status

This allows you to verify exactly what data left your machine at any point in time.

Self-Hosted Private Instance

For maximum privacy, run your own Threat Cloud instance:

# Start your private instance
panguard threat start --port 8080 --api-key your-key

# Point agents to your private instance
panguard guard start --threat-cloud http://your-private-server:8080

With a self-hosted instance:

All threat data stays within your network
You control retention, access, and deletion policies
You still benefit from external feed synchronization (ThreatFox, URLhaus, etc.)
Cross-agent correlation works across your fleet
No data leaves your network perimeter

Panguard Threat Cloud is designed with GDPR principles:

Principle	Implementation
Data minimization	Only the minimum data needed for threat correlation is collected
Purpose limitation	Data is used exclusively for threat intelligence
Storage limitation	Configurable retention periods (default: 90 days) with automatic purge
Right to erasure	Self-hosted instances have full control over data deletion
Data protection by design	Anonymization is applied at the source, before any data leaves the agent

For organizations with strict data sovereignty requirements, combine a self-hosted Threat Cloud with disabled public sharing. This gives you collective intelligence within your organization without any data leaving your network.

Products

Panguard Scan

Panguard Guard

Panguard MCP

Threat Cloud

Anonymization

IP Address Masking

What Is Shared

What Is Never Shared

Zero Telemetry

Data Retention

Opt-Out (Offline Mode)

Audit Logging

Self-Hosted Private Instance

​Anonymization

​IP Address Masking

​What Is Shared

​What Is Never Shared

​Zero Telemetry

​Data Retention

​Opt-Out (Offline Mode)

​Audit Logging

​Self-Hosted Private Instance

​GDPR Compliance

Anonymization

IP Address Masking

What Is Shared

What Is Never Shared

Zero Telemetry

Data Retention

Opt-Out (Offline Mode)

Audit Logging

Self-Hosted Private Instance

GDPR Compliance