Privacy is a core design principle of Panguard Threat Cloud. All threat data is anonymized before leaving your machine, zero telemetry is collected, and the entire system can operate fully offline with a single configuration flag.
Anonymization
IP Address Masking
All IP addresses are /16-anonymized before submission. The last two octets are zeroed:
| Original IP | Anonymized IP |
|---|
192.168.1.50 | 192.168.0.0 |
10.0.42.100 | 10.0.0.0 |
203.0.113.50 | 203.0.0.0 |
What Is Shared
| Data | Shared | Anonymization |
|---|
| Attacker source IP | Yes | /16 masked (last two octets zeroed) |
| Attack type and technique | Yes | Already generic, no anonymization needed |
| MITRE ATT&CK IDs | Yes | Public taxonomy, no anonymization needed |
| Confidence score | Yes | No anonymization needed |
| File hashes (malware) | Yes | Hash only, no file content |
| Timestamps | Yes | Rounded to nearest hour |
| Tags and classification | Yes | Already generic |
What Is Never Shared
| Data | Status |
|---|
| Your machine’s IP address | Never transmitted |
| Hostnames or machine IDs | Never transmitted |
| Internal IP addresses | Never transmitted |
| File contents | Never transmitted |
| Log entries or raw events | Never transmitted |
| User credentials | Never transmitted |
| Configuration details | Never transmitted |
| Scan results | Never transmitted |
| Usernames or account names | Never transmitted |
Zero Telemetry
Panguard collects zero telemetry about your usage:
- No usage analytics
- No crash reports sent externally
- No feature tracking
- No license phone-home beyond initial activation
- No third-party analytics SDKs
- No browser fingerprinting
- No session recording
Data Retention
| Setting | Default | Description |
|---|
| IoC retention | 90 days | Indicators older than 90 days are automatically purged |
| Submission logs | Local only | Kept on your machine, never uploaded |
| Feed cache | Refreshed every 6 hours | Local cache of external feed data |
Opt-Out (Offline Mode)
Threat Cloud sharing can be disabled entirely for air-gapped or privacy-sensitive environments:
# Disable Threat Cloud in Guard
panguard guard config --threat-cloud disabled
# Or set via environment variable
export PANGUARD_THREAT_CLOUD=disabled
# Or disable per-session when starting Trap
panguard trap start --services ssh,http --no-cloud
- No data is submitted to any Threat Cloud instance (public or private)
- Guard continues to function with local detection only (Sigma rules, YARA, baseline)
- Threat intelligence lookups use only the last-synced local feed cache
- No network connections are made to Threat Cloud endpoints
- All other features remain fully operational
Offline mode reduces detection capability since you lose access to collective threat intelligence. Consider running a private Threat Cloud instance within your network as a middle ground between full sharing and complete isolation.
Audit Logging
All data submissions to Threat Cloud are logged locally for audit purposes:
# View submission log
cat ~/.panguard/threat-cloud/submissions.log
| Field | Description |
|---|
timestamp | When the submission was made |
data | The exact anonymized data that was sent |
endpoint | Threat Cloud URL that received the data |
status | HTTP response status |
Self-Hosted Private Instance
For maximum privacy, run your own Threat Cloud instance:
# Start your private instance
panguard threat start --port 8080 --api-key your-key
# Point agents to your private instance
panguard guard start --threat-cloud http://your-private-server:8080
- All threat data stays within your network
- You control retention, access, and deletion policies
- You still benefit from external feed synchronization (ThreatFox, URLhaus, etc.)
- Cross-agent correlation works across your fleet
- No data leaves your network perimeter
GDPR Compliance
Panguard Threat Cloud is designed with GDPR principles:
| Principle | Implementation |
|---|
| Data minimization | Only the minimum data needed for threat correlation is collected |
| Purpose limitation | Data is used exclusively for threat intelligence |
| Storage limitation | Configurable retention periods (default: 90 days) with automatic purge |
| Right to erasure | Self-hosted instances have full control over data deletion |
| Data protection by design | Anonymization is applied at the source, before any data leaves the agent |
For organizations with strict data sovereignty requirements, combine a self-hosted Threat Cloud with disabled public sharing. This gives you collective intelligence within your organization without any data leaving your network.
