Security & privacy of Tracknosis

A security tool should be the easiest thing on your machines to trust. Here is exactly what Tracknosis does on a Windows machine, where its results live, and what, if anything, leaves the machine.

At a glance

Local by default, nothing sent unless you choose

Reads, doesn't change

Tracknosis reads the file system and registry directly from the disk. It doesn't modify the files and registry keys it examines.

Results stay local

Scan history is kept in a local database on the machine running Tracknosis. There is no Tracknosis cloud and no telemetry sent to us.

You control what leaves

Data leaves the machine only through integrations you switch on yourself: sending findings to your Splunk, or drafting a report with AI.

On the machine

What Tracknosis does when it runs

How it runs

A lightweight agent: a Windows application you start when you want to scan
Runs with administrator rights, which Windows requires to read a volume directly
No kernel driver, no always-on service, no hooks into Windows
Doesn't switch on auditing or change logging or audit settings

How it treats the evidence

Reads the NTFS master file table and registry hives directly from the disk
Doesn't modify the files and registry keys it examines
Checking digital signatures preserves files' last-access times
Recovered deleted files are never written back to the volume under investigation

Your data

What is stored, and where

What it records

File and registry metadata: names, paths, sizes, timestamps, owners and attributes
Registry values, so changed auto-starts and settings can be shown
Download origin (Mark of the Web) for files that came from the internet
Risk ratings and the reason for each
Each scan stamped with machine, volume, tool version, operator and time

Tracknosis doesn't copy the contents of your documents into its database.

Where it's kept

A local database on the machine running Tracknosis
An open, standard format (SQLite), so you can inspect it with your own tools
Kept as long as you choose; deleting the data folder removes it
Never uploaded to Tracknosis

Network

What leaves the machine, and only when you ask

Scanning itself needs no network connection. These optional features do, and each one runs only when you turn it on or click it.

Sending findings to Splunk

When you enable it, findings are sent to your own Splunk HTTP Event Collector. The collector token is encrypted with Windows data protection (DPAPI) for the user who saved it, not stored in plain text.

AI report drafts

When you ask for an AI report draft, the change data selected for that report is sent to the AI provider (Anthropic's Claude API) using your organisation's own API key. Nothing is sent unless you generate a draft. The draft is for your team to review before it goes anywhere.

Network reference lists

If you choose to update them, Tracknosis downloads public reference lists (IP location, Tor and VPN ranges) to label network connections. These are downloads only: no data from your machine is sent.

Online file lookups

If you click to look up a file online, its hash (a fingerprint, not the file itself) is opened in your browser on VirusTotal. This happens only when you click.

For your security review

Questions from your security or procurement team?

We're happy to go through your questionnaire, walk through how Tracknosis handles data on your machines, or run it with you on a test system first.

Ask a security question Deployment & requirements