Overseer
What Overseer sends us
Every field that can leave your device, listed one by one. This is the data map itself, not a summary of a policy.
- Windows dev build
- Metadata only
- No TLS interception
There is no signed installer, no macOS or Linux client, and nothing that can hold a connection open while it asks you. Everything here describes what exists today, not what is planned.
The short version
In this build, the only things Overseer sends us are the ones needed to activate the installation and confirm your plan: a public key the app generated on your machine, the platform and version, the device name you see on your account page, and the address the request came from.
No fingerprints, destinations, flows, alerts or rules are uploaded by this build. Reputation lookups and hive contribution are not implemented yet. When they are, every new field appears in the table below first, and you are asked before any upload starts.
Sent to Defynta
| Field | When | Why | Kept for |
|---|---|---|---|
installationPublicKeybase64 P-256 SubjectPublicKeyInfo | First activation | Binds the device credential to a key held only by this installation | Until the device is revoked, then 12 months in the security audit |
platform / architecture / appVersionwindows / x86_64 / 0.1.0-dev | Activation and entitlement refresh | Serve the right release and report honest capability state | Life of the device record |
deviceNameWindows device | Activation | Lets you tell your own devices apart on the account page | Life of the device record |
activationRequestIp203.0.113.10 | Activation request and approval | Abuse and rate limiting for the activation endpoints | 12 months in the audit record |
Stays on your device
| Field | When | Why | Kept for |
|---|---|---|---|
executableSha256e3b0c442... | Every running process the daemon can read | Local identity, rule matching and change detection | Local history retention (default 30 days); rules keep theirs |
localExecutablePathC:\Program Files\Example\app.exe | Process enumeration | Shown in Details so you can identify the program | Local only. Never uploaded and never written to ordinary logs |
remoteAddress / remotePort / domain203.0.113.12 : 443 / api.example.net | Observed flow | Attribution, scoring and rule creation | Local history retention (default 30 days) |
rules, alerts and decisionsallow outbound TCP 443 for <hash> | Your decisions | Enforcement and audit | Until you delete them |
Never collected
| Field | When | Why | Kept for |
|---|---|---|---|
packet payloads and TLS plaintext | - | Out of scope. There is no TLS interception and no local root certificate | - |
full URLs, cookies, credentials, headers | - | Out of scope | - |
command lines, environment variables, window titles | - | Out of scope by default | - |
hostname, username, browser history, documents, screenshots | - | Out of scope | - |
Words we are careful about
- An executable fingerprint is pseudonymous, not anonymous. A hash can reveal which software and which version you run.
- A hashed domain is not anonymous either - a dictionary reverses it. That is why domains are not routine training data.
- We encrypt data in transit and at rest. We do not make “military grade” claims about it.
- Deleting a device revokes its credential and schedules deletion of linkable records. Aggregates that already crossed a privacy threshold cannot always be unwound, and we say so rather than pretending otherwise.
Your controls
- Export and delete local history with no internet connection.
- Revoke a device from the app or your account page. It takes effect on the next request.
- Turn off cloud features and keep local monitoring, rules, history and uninstall intact.
- Send a support bundle only after previewing every field. They contain no address, domain, path, hash, username or token by default.
Manage your installations on the Overseer devices page. The full field-level map, including fields planned for reputation and hive features, lives at docs/overseer/privacy-data-map.md.