One of the most common questions we get is about data privacy. At Monarx, our goal is to protect your server, and to do that effectively, our on-site agent works in tandem with our cloud-based intelligence engine.
Here is a clear breakdown of exactly what data leaves your server and why.
1. File Metadata (The "Snapshot")
When you enable Monarx, our agent scans the files on your server (typically everything in your /home/ directory). Instead of sending every single file to the cloud, the agent first sends metadata.
What is metadata? Think of it like the information on a library card rather than the book itself. It includes things like the file name, size, and a "digital fingerprint" (hash).
Why we do it: This allows our cloud to quickly see if we have already analyzed this exact file elsewhere. If we recognize the fingerprint as "safe," no further action is taken.
2. Deep File Analysis (The "Close-up")
If our agent encounters a file that is unique (we’ve never seen it before) and interesting (it contains characteristics common in malware), the cloud will request a copy.
What happens: The agent uploads that specific file to our secure storage (Amazon S3).
The Goal: We deconstruct the file to see what it does and what it looks like. Our system then decides if it is "good," "bad," or if it needs a human security researcher to take a look.
Privacy Note: While we only look for malware, we know sensitive info can sometimes end up in file content. If our systems detect sensitive data, it is purged from our records immediately.
3. Attack Telemetry (The "Security Footage")
If a hacker or a malicious bot interacts with your site, Monarx captures telemetry data about that specific event.
What we collect: * The IP address that started the request.
The URL and Headers used in the attack.
Which specific files the attacker tried to touch.
Why we do it: This helps us understand the source of the attack. It allows us to block the threat globally and provides you with the "who, what, and where" in your Monarx dashboard.
Where can I see this data?
Once our cloud finishes its analysis, the final classification (whether the file is safe or malicious) and the supporting data are sent back to your Monarx UI and API. This gives you a clear, real-time view of your server's health.