Security
Data Collection
Section titled “Data Collection”What Data is Collected
Section titled “What Data is Collected”Scanopy stores information about devices and services on networks you configure for scanning:
- Network devices: IP addresses, MAC addresses, hostnames, device types
- Services: Open ports, protocol information
- Topology: Network relationships and connectivity between devices
- Metadata: Discovery timestamps, scan configurations
Data Storage
Section titled “Data Storage”- Self-hosted: All data is stored locally in your PostgreSQL database. No data is sent to external servers.
- Scanopy Cloud: Data is stored in our secure cloud infrastructure. See our Privacy Policy for details.
Network Behavior
Section titled “Network Behavior”Daemon Communication
Section titled “Daemon Communication”Scanopy daemon communicates with the server using:
- Pull mode (default): Daemon polls the server for scan instructions
- Push mode: Server connects to daemon to initiate scans (requires daemon to be accessible from server)
Network Discovery
Section titled “Network Discovery”The daemon performs passive and active network discovery:
- ARP scanning to discover devices on local network segments
- Port scanning to identify running services
- Optional Docker API inspection for container discovery
Encryption
Section titled “Encryption”- Scanopy Cloud: All communication uses HTTPS/TLS encryption
- Self-hosted: HTTP by default for local deployments. HTTPS should be configured if exposing the server over the internet (via reverse proxy like nginx, Caddy, or Traefik)
Permissions
Section titled “Permissions”Daemon Requirements
Section titled “Daemon Requirements”The Scanopy daemon requires elevated permissions for network scanning:
- Linux: Root access or
CAP_NET_RAWcapability for raw socket access (ARP scanning) - Docker: Access to Docker socket for container discovery (optional)
- macOS/Windows: Administrator privileges for network scanning
Server Requirements
Section titled “Server Requirements”The Scanopy server runs as a standard user process with no special permissions required.
External Connections
Section titled “External Connections”Self-hosted Deployments
Section titled “Self-hosted Deployments”Self-hosted Scanopy makes minimal external connections:
- Docker Hub / GitHub Container Registry: For pulling container images (if using Docker deployment)
- No telemetry: No usage data is sent to Scanopy or third parties
Scanopy Cloud
Section titled “Scanopy Cloud”Cloud deployments connect to:
- Scanopy API servers for data synchronization
- PostHog for anonymous usage analytics (can be opted out via cookie settings)
- Plunk for transactional emails, and marketing emails (which can be opted out during registration)
- Stripe for payment processing (billing-related only)
Reporting Security Issues
Section titled “Reporting Security Issues”If you discover a security vulnerability, please report it responsibly:
- Email: [email protected]
- Do not disclose publicly until we’ve had a chance to address the issue
Questions?
Section titled “Questions?”For security-related questions not covered here, contact us at [email protected].