Most security pages assert "we don't send your data." We list every request the binary can make, when it fires, what is inside it, and how to stop it, including the one that goes to a third party rather than to us. Read the ledger below, then verify it yourself with tcpdump.
Honest scope. The product is narrow on purpose: it finds PII in files you point it at, and it does that locally. It is not an EDR, a DLP suite, or a magic compliance button.
SENTRY_DSN="" removes them from the listFour requests. Two of them only if you ask for them. None of them carry your scan data. The exact payloads are below.
Starts email verification, so we can send you the link that unlocks the license.
Sent by piicrawler register, by the terminal UI's register screen, and by the web UI's. Form-encoded, not JSON. Nothing else in the product calls it.
drop a license.lic file in ~/.piicrawler
application/x-www-form-urlencodedCollects the issued license once your email is verified, and activates the binary.
Not a single request: while it waits for you to click the link in the email, PII Crawler polls this endpoint every few seconds until the license comes back or you give up. The web UI's Refresh license button calls it again. The OS and CPU architecture are sent so we hand back a license for the build you are running.
drop a license.lic file in ~/.piicrawler
application/x-www-form-urlencodedTells piicrawler update whether a newer build exists. You decide whether to fetch it.
There is no background update check, no check at launch and no check from the UI: this request happens when, and only when, you run the update subcommand. A static JSON. No body sent, no cookies. If you then confirm the upgrade, a second GET fetches the archive named in url and its SHA-256 is checked against the sha256 here before anything is swapped in.
don't run `piicrawler update`
Helps fix crashes. Never sent on a run that finishes.
Crash reports do not go to Eligian's own servers. They go to Sentry (Functional Software, Inc., United States), the error-tracking service we use, over the Sentry SDK's own protocol. If your policy requires that no telemetry leave for a third-party processor, turn it off with the variable below; everything else on this page is unaffected.
The payload is a Sentry event, and it carries more than the exception: the product version, the machine's hostname, the OS name, version and kernel version, the CPU architecture, and the on-disk path of the PII Crawler binary and of every shared library it had loaded, which on a normal install is a path under your home directory. An error message can name a file path too (the database file that would not open, say) and that path is sent as written. File contents, scan results and anything a scan matched are not put into error messages and are not sent.
SENTRY_DSN="" piicrawler …
That is the whole list. There is no analytics endpoint. Neither the CLI nor the web UI reports feature usage anywhere, and the web UI loads no third-party script. The one other address the binary can post to is the webhook you configure with piicrawler watch --webhook, which goes wherever you point it and carries the policy name, the file path and a masked value. If we ever add an endpoint, this page changes first.
There is no --air-gapped flag, because scanning needs no flag: scan, report, export, findings, dsar and watch open no outbound connection. Two things have to be arranged once, and then the host can stay off the network for good.
license.licupdateSENTRY_DSN=""PII Crawler runs as your user. It can only see what you can see. There is no service to start, nothing to add to sudoers.
Every category of data, every endpoint. A dot marks something that is sent. A cross marks something that is never sent under any condition. The Analytics column is empty all the way down because there is no analytics endpoint; it is kept so the answer is on the record.
a. PII Crawler has no analytics endpoint at all. The column exists only so the row can say so.
b. A crash report carries the on-disk path of the PII Crawler binary and of every shared library it had loaded, and an error message can name a file the product itself was opening: its own database, a log file, a licence file. No path of a file you scanned is put into an error message.
c. Only as part of those paths: on a normal install they sit under your home directory, and a home directory is usually named after the account.
d. Nothing in the binary reads or attaches an IP address. Any server you connect to necessarily observes the address you connect from; that is true of the four requests above and of every other program on the machine.
Four concrete checks any sysadmin can run. None take more than a few minutes, and the fourth one shows you a crash report before it is sent.
Block egress from the host, then scan. Registration is the only thing that needs the network, and a license.lic covers that; the scan itself never tries.
iptables -A OUTPUT -m owner --uid-owner piicrawler -j DROP
Capture every interface while a scan runs and inspect the pcap. There is nothing to find.
sudo tcpdump -i any -n -w scan.pcap & piicrawler scan ~/share
The SHA-256 of every published build is in the same manifest piicrawler update reads, and update checks it before swapping anything in. Compare it against the file you downloaded.
curl -s https://downloads.eligian.com/piicrawler-cli-linux.json | grep sha256; sha256sum piicrawler-cli-linux.tar.gz
Crash reports go wherever SENTRY_DSN points. Point it at a listener of your own and you see the exact bytes we would have received. That is how the payload above was captured.
SENTRY_DSN=http://[email protected]:9911/1 piicrawler serve
macOS and Windows builds carry a platform signature you can check with the platform's own tool. The Linux tarball has no detached GPG signature. Its check is the SHA-256 published in the same manifest piicrawler update reads, and that is the hash update itself verifies before it swaps a binary in.
Email the security team directly. We respond within 48 hours, work the fix with you privately, and credit you in the release notes if you'd like.