Most security pages assert "we don't send your data." We list every byte that leaves the binary, when it leaves, and the flag that turns it off. Read the ledger below — then verify it yourself with tcpdump.
Honest scope. The product is narrow on purpose: it finds PII in files you point it at, and it does that locally. It is not an EDR, a DLP suite, or a magic compliance button.
Four endpoints. Three optional. None of them carry your scan data — see the exact request bodies below.
Verifies your purchase and activates the binary.
Bypass entirely with an offline license token issued by Eligian Labs.
--offline-license <token>
Tells you when a new version exists. You decide whether to fetch it.
A static JSON. No body sent. No cookies. No User-Agent string beyond the default.
--no-update-check
Helps fix crashes. Never sent on a clean run.
Stack trace is filtered for absolute paths under your home directory before send.
--no-error-reporting
Tells us which UI features matter so we can prioritize.
CLI-only usage sends zero analytics events. Ever.
--no-analytics (or just use the CLI)
This list is exhaustive. If we ever add an endpoint, this page changes first.
--air-gapped disables all four endpoints in one command. --verify-airgap opens a packet listener while the scan runs and prints the count of outbound packets at the end.
PII Crawler runs as your user. It can only see what you can see. There is no service to start, nothing to add to sudoers.
Every category of data, every endpoint. A green check is something that is sent. A red ✗ is something that is never sent under any condition.
Three concrete checks any sysadmin can run. None take more than a few minutes.
Block egress from the host. Run a scan with --air-gapped. Watch the scan complete with zero connection attempts in your firewall logs.
iptables -A OUTPUT -m owner --uid-owner piicrawler -j DROP
Capture the loopback and external interfaces while a scan runs. Inspect the pcap. There is nothing to find.
sudo tcpdump -i any -n -w airgap.pcap & piicrawler scan ~/share --air-gapped
macOS: codesign --verify. Windows: signtool verify. Linux: gpg --verify against the published .sig. SHA256 of every release on this page.
codesign --verify --strict --verbose=2 /Applications/PIICrawler.app
We code-sign every binary on every platform. Hashes and detached signatures are published before the binary is. Fingerprint your download, then compare.
Email the security team directly. We respond within 48 hours, work the fix with you privately, and credit you in the release notes if you'd like.