Privacy statement
Every request a device makes.
Each request a device makes to Guard Cloud, with its fields, retention and controls.
Leaving the device
Every request a device makes to Gurd Cloud.
Each is signed with the device's own key, and Guard Cloud checks each body against the same allowlist the device uses. Nothing is sent anywhere other than the enrolled Guard Cloud.
Agent activity
| Request | Purpose | Fields | Retention in Guard Cloud | Controls |
|---|---|---|---|---|
POST /v1/device/inventory | Which AI tools, MCP servers and agent configurations are installed. | schema_version, generated_at, records, truncated, selections, coverage | Latest inventory per device; daily counts deleted on schedule after device_metrics_retention_days: 200 days unless the server or an organization administrator sets 186 to 730. | Paths are reduced to hashed keys; local model names, including loaded models, must not be paths; a loaded model's name is uploaded only when public (a bare name or a catalog-listed publisher's owner/name), else as a device-keyed hash; validated by runeward_guard::inventory::check on both ends. |
POST /v1/device/findings | Detections about agent activity. Detections in the human_ai_sharing category are included only when that opt-in is on. | time, rule, detection_id, outcome, action, framework_mappings, mapping_review, category, attribution_confidence, confidence, harness, surface, attribution, actor_pid, actor_pid_version, process_tree_key, actor_is_harness, path_key, operation, evidence_source, actor_origin, tool, permission, egress, host_app, container, signature, session, message, policy_profile, identity, delegation, model_assist, file_access, mcp_server, mcp_operator, agent_launch, credential_service, ai_api_contact, earlier_run, dns_lookups, pickle_load, ai_app, source, package, recipient, agent_context, ai_account | Enterprise: kept for replay and audit; no automatic deletion. Startup: deleted on schedule once older than startup_history_retention_days (90 days; an administrator may set 30 to 90), unless long_history is on; the findings chain hashes stay. A move to Startup, or the end of a long_history override, waits startup_history_grace_seconds (30 days) before anything is deleted. On every plan, findings linked to an incident stay while the incident exists, and an open incident's device history around its findings is held. | Field allowlist on both ends (FINDING_FIELDS). A human_ai_sharing finding stays on the device while that opt-in is off (only its chain hash is sent), and Guard Cloud refuses one sent anyway. A package_lookalike or package_not_on_registry finding's package block names a package only when the name matched public data: a look-alike of a name on the built-in reference list from public download rankings (the typed name and the name it resembles), or a name the public registry's snapshot or a lookup showed missing. A package_malicious_release, package_needs_patching, package_below_minimum_version or package_disallowed_version finding (guard packages check --record) names a package and its version only when a public advisory in the signed snapshot names it or it is a language runtime, with the advisory ID, its CVE aliases, severity, fixed version and the policy rule; a package that only an organization version rule matched is reported by rule with name_withheld private_package. The matching is done on the device, never a path or a package list. Names a private or command-line registry may serve, names that resemble a reference name an organization's policy added, and names the check couldn't settle stay on the device; the block then says why with name_withheld. A recipient_rule finding's recipient block holds each recipient's channel kind, standing against the recipient rules, domain and a 128-bit keyed hash of the address (keyed by the organization's hash_key, else by the installation's salt); never the address, a channel name or the message, and Guard Cloud refuses a block that does. An ai_account block holds the harness, a status, its basis and an email domain or a keyed tenant hash, never an address, a raw ID or a token. An agent_context block holds only state unknown and a closed reason code, never a component name or person. An mcp_operator block holds a closed mechanism, change and pinning code and the operators: a certificate organization or registry namespace as published, an OAuth issuer only as its SHA-256; never a host or URL. |
POST /v1/device/queued-findings | Native sensor findings delivered through the encrypted queue. | schema_version, stream, queue_receipt, records | As findings: Enterprise keeps them with no automatic deletion; Startup deletes them once older than startup_history_retention_days (90 days), unless long_history is on. A move to Startup, or the end of a long_history override, waits startup_history_grace_seconds (30 days) before anything is deleted. On every plan, findings linked to an incident stay while the incident exists, and an open incident's device history around its findings is held. | Narrow value-level contract (docs/queue-finding-metadata.md); Guard Cloud applies the same human_ai_sharing refusal. |
POST /v1/device/session-steps | The ordered metadata steps of agent sessions. | schema_version, session_key, scope, harness, stream, stream_started_at, restart_reason, steps, losses, join, refusals | Enterprise: kept for replay and audit; no automatic deletion. Startup: deleted on schedule once older than startup_history_retention_days (90 days; an administrator may set 30 to 90), unless long_history is on, with streams left empty. A move to Startup, or the end of a long_history override, waits startup_history_grace_seconds (30 days) before anything is deleted. On every plan, findings linked to an incident stay while the incident exists, and an open incident's device history around its findings is held. | Metadata only: step kinds, rule names, tool names, hosts, digests, MCP server registry names or hashed labels, file classes and step references; never prompt or tool text, paths or URLs. |
POST /v1/device/mcp-inventory | Which MCP servers each opaque OS-user scope has configured, for the Console MCP view and change detection. | schema_version, os_user_key, report_sequence, inventory | Latest servers per device and opaque OS-user scope, with bounded absent and historical unscoped rows, and the newest 500 change events per device. | Version 2 wraps strict local inventory metadata in an opaque OS-user key derived by the trusted uploader (the root receiver on Linux) and a positive sequence. Linux users submit to a bounded local receiver; the existing enrolled root sync delivers their inventories. Other platforms upload from their enrolled user. Unchanged accepted content is deduplicated per enrolled device and normalized server destination; a catalog with mcp_inventory_auto_upload false leaves only on-demand delivery. Nested inventory contains its observation time, truncation, registry reference and servers: keyed digests, registry names or hashed labels, closed codes (including whether each server runs through the MCP gateway), and each baseline tool's escaped name, definition digest and poisoning verdict only; never a tool description, schema or annotation. No raw UID, account name, config entry name, path, command, argument, host, environment value or secret is accepted. |
POST /v1/device/mcp-activity | Daily counts of MCP tool calls the gateway decided, per server and tool, and of servers the Console's MCP block list or approval rule refused, per server, with the call identities of the calls' tokens per server, for the Console's MCP activity view, its used-versus-granted scope view and the risk score's MCP token findings. | schema_version, sequence, records, identities | Daily counts per device, day, server, tool, harness and decision, call-identity summaries per device, day, server, harness and decision (the subject only as the organization-keyed hash), and the days each device reported; deleted on schedule after mcp_activity_retention_days: 200 days unless the server or an organization administrator sets 186 to 730. Each organization's subject-hash key is kept until the organization is deleted. | Each record is exactly day, server (a registry name or an mcp-server- label, or null when unidentified), server_kind, tool (escaped printable ASCII, never token-shaped), harness, decision and calls, checked by runeward_guard::mcp::activity::check_report on both ends; no argument, result, token, identity, config name, path or URL is accepted. Each identity is exactly day, server, server_kind, harness, decision, status, issuer_host (a lowercase host, never a URL), subject_digest (64 hex digits), subject_class, scopes and excess_scopes (sorted, excess a subset of scopes, never token-shaped), scopes_truncated, expired, over_scoped and calls, all null or empty except status unless the token was decoded; Guard Cloud replaces subject_digest with HMAC-SHA256 under the organization's own key (mcp_subject_keys) and never stores the digest, so a subject is the same within an organization and differs across them. The Console counts subjects and never lists them. An organization-policy refusal is a record with tool null and decision blocked or ask_refused. Reports are numbered per device and applied once. On Linux each user's watch hands its counts to the bounded local receiver (runeward_guard::mcp::activity::check_local_batch, the same record check plus call-log cursors that stay on the device), and the enrolled root sync sends them in the device's report; other platforms upload from their enrolled user. Device counts below 3 are withheld in every Console response with the call counts beside them; no response names, lists or ranks a person or a device. |
POST /v1/device/evidence | Posture drift, credential inventory, attack paths and remediation ledger records the device computes, for the Console's evidence views. | schema_version, generated_at, posture_drift, credentials, attack_paths, remediation | Latest section per device; the newest 1000 drift changes and 2048 ledger records per device. | At guard cloud sync when evidence changed since the last accepted upload, and on demand (guard cloud evidence; guard evidence --upload-preview prints it); a catalog with evidence_auto_upload false leaves only the on-demand upload. Catalog names, closed codes, salted digests, counts and times only: credentials by variable name or kind, never a value or a reference to one; no path, MCP server name, approver, operator or free text. Both ends refuse an upload that matches a built-in secret pattern. Per-session credential reads stay in session replay under the session content opt-in. |
POST /v1/device/data-access | Which catalog data classes agents opened. | schema_version, generated_at, platform, catalog_serial, taxonomy_version, retention_days, window_start, coverage, classes, document_labels | Latest report per device. | Class and harness identifiers, hashed path keys and timestamps only. With privacy.document_labels on, a labels section adds SHA-256 digests of label IDs, the mapped class, harness names and counts; never a label name or text. The upload checker (runeward_guard::data_access::check_upload, on the device and in Guard Cloud) refuses anything else. |
POST /v1/device/assessments | An opt-in agent configuration assessment report, sent only by guard cloud assessment. | schema, schema_version, generated_at, tool, mode, statement, privacy, inputs, scoring, findings, resolved, coverage, limitations | Latest report per device. | Only hashed-path reports are accepted (runeward_guard::assessment::check_upload on both ends); sent only when an operator runs guard cloud assessment. |
POST /v1/device/approvals/request | Ask an administrator to approve one exact agent action. | schema_version, binding, expires_in_seconds | Deleted once expired. | The action and session are SHA-256 digests; no command or argument text. |
POST /v1/device/approvals/poll | Read an approval decision. | schema_version, request_id, binding | As approval requests. | Digests only. |
POST /v1/device/approvals/consume | Consume an approval once. | schema_version, receipt, allowed | As approval requests. | Digests only. |
Device operations
| Request | Purpose | Fields | Retention in Guard Cloud | Controls |
|---|---|---|---|---|
POST /v1/enroll | Enroll the device with a one-time token. | token, installation_id, display_name, os, architecture, public_key, key_identity, installed_by_agent | Device record kept until the device is retired or revoked; no automatic deletion. | display_name is the label the operator chose at enrollment, never read from the host name. installed_by_agent is only the catalog name of the AI agent CLI found among the installer's parent processes, and how it was recognised; no command line, path or user name. |
POST /v1/enroll/recover | Recover an interrupted enrollment. | schema_version, installation_id, key_identity | As enrollment. | Signed with the pending device key. |
POST /v1/device/status | Coverage health: which collectors and hooks run, the running sensor's account and binary signature verdict, the offline store's state, and data path keys (hashes keyed with a per-installation salt, never paths). | device, agent_version, checked_at, health, key_identity | Latest status per device, replaced on every sync. | Strict value-level validator on both ends (docs/status-privacy.md); no host name, paths or diagnostic text. |
POST /v1/device/events | Tamper and health events, such as hooks removed or the sensor stopping. | schema_version, stream, dropped, loss_notice_id, events | Enterprise: kept for replay and audit; no automatic deletion. Startup: deleted on schedule once older than startup_history_retention_days (90 days; an administrator may set 30 to 90), unless long_history is on. A move to Startup, or the end of a long_history override, waits startup_history_grace_seconds (30 days) before anything is deleted. On every plan, findings linked to an incident stay while the incident exists, and an open incident's device history around its findings is held. | Event kinds and detail keys are identifiers; values are bounded identifiers and numbers. |
POST /v1/device/collector-health | Native collector health codes and counters. | schema_version, producer, notice_id, observed_at, code, counters, dropped_observations | Enterprise: kept for replay and audit; no automatic deletion. Startup: deleted on schedule once older than startup_history_retention_days (90 days; an administrator may set 30 to 90), unless long_history is on; each device's newest report per producer is always kept. A move to Startup, or the end of a long_history override, waits startup_history_grace_seconds (30 days) before anything is deleted. On every plan, findings linked to an incident stay while the incident exists, and an open incident's device history around its findings is held. | Fixed codes and counters only. |
POST /v1/device/queued-health | Health status delivered through the encrypted queue. | schema_version, origin, queue_receipt, queue_sequence, status | Latest per queue origin. | status passes the same validator as /v1/device/status. |
POST /v1/device/log-key | Register the MAC key of the findings chain, so changed or missing findings are detected. | key, stream | Kept for the life of the findings chain. | Key material for integrity checks only. |
POST /v1/device/log-key/status | Ask whether a findings stream's MAC key is registered. | schema_version, user_id, chain_id, predecessor, terminal_state_sha256, request, receipt, producer | Not stored. | Chain identifiers, digests and key renewal receipts only. |
POST /v1/device/key/renew | Renew the device signing key. | schema_version, operation_id, device_id, installation_id, previous_public_key, successor, successor_proof | Key history kept so retired keys can't re-enroll. | Public keys and proofs only. |
POST /v1/device/key/recover | Recover an interrupted key renewal. | schema_version, operation_id, device_id, installation_id, previous_public_key, successor, successor_proof | As key renewal. | Public keys and proofs only. |
GET /v1/device/key/status | Read the device key's validity. | None | Not stored. | Signed request without a body. |
POST /v1/device/key/renew/cancel | Cancel a pending key renewal. | schema_version, operation_id, device_id, installation_id, previous_public_key, successor_public_key | Cancellation receipt kept. | Public keys only. |
POST /v1/device/certificate | Issue the optional per-device mTLS certificate. | schema_version, public_key | Certificate record kept until it expires or the device is retired. | Public key only. |
GET /v1/device/catalog | Download the signed catalog, which carries the privacy opt-ins. | None | Not applicable: a download. | The device verifies the signature, serial floor and expiry. |
POST /v1/device/catalog/applied | Which Guard Cloud catalog serial is in force on the device, for rollout status. | serial, applied_at | The latest report per device. | Sent at each guard cloud sync after the signature, serial floor and expiry checks. Guard Cloud accepts only a serial the organization published. |
GET /v1/device/identity-snapshot | Download the signed directory identity snapshot for identity-aware rules. | None | Not applicable: a download. | Verified against the signed catalog's keys. |
GET /v1/device/mcp-reference | Download the signed MCP registry reference set. | None | Not applicable: a download. | Verified against the signed catalog's keys. |
POST /v1/device/update-roots | Download update signing roots. | schema_version, installation_sha256, platform, current_version, current_root_sha256 | Delivery receipts kept. | The installation is a SHA-256 digest; the roots are verified on the device. |
POST /v1/device/commands | Pull signed remote response commands (#308). | schema_version | Not applicable: a download. | Each command is verified against the device's pinned command keys; commands carry a harness, a hashed hook session key or an isolation end time, never session content. |
POST /v1/device/commands/ack | Report each remote response command's result. | schema_version, results | Kept with the command for the tenant's audit. | A closed result code and counts only. |
Human ai sharing
| Request | Purpose | Fields | Retention in Guard Cloud | Controls |
|---|---|---|---|---|
POST /v1/device/ai-app-use | Daily counts of AI web app use, for the Console's Shadow AI view and the first-use finding for an unsanctioned app. | schema_version, records | Daily counts per device, app, origin and source: Enterprise keeps them until the device or organization is deleted; Startup deletes them once older than startup_history_retention_days (90 days), unless long_history is on. A move to Startup, or the end of a long_history override, waits startup_history_grace_seconds (30 days) before anything is deleted. First and last seen per device and app are kept until the device or organization is deleted on every plan. | Refused unless the organization opted in to human_ai_sharing, and for a day before the opt-in. Each record is exactly app_id, origin (https://host, matching the app in the directory), day, count and source (extension or network); no URL path, title, query, prompt or content. Device counts below the policy's shadow_ai.minimum_count (at least 3) are withheld in every Console response; no response names a person or device. |
POST /v1/device/ai-app-review-requests | Review requests from the browser extension's block page, for the Console's Shadow AI review request list. | schema_version, requests | One row per device and app with the first and last request time, kept until the device or organization is deleted; no automatic deletion yet. | Refused unless the organization opted in to human_ai_sharing, and for a request from before the opt-in. Each request is exactly app_id (in the organization's directory) and requested_at (within the last 7 days); no reason, message, URL, title or anything typed. Device counts below the policy's shadow_ai.minimum_count (at least 3) are withheld in the Console, with their days; no response names a person or device. |
Session content
| Request | Purpose | Fields | Retention in Guard Cloud | Controls |
|---|---|---|---|---|
POST /v1/device/session-content | Redacted session content, only under the tenant-wide opt-in or an escalation covering the device or session. | schema_version, records | Deleted after the basis's retention period: the tenant-wide retention_days, or the escalation's (at most 90 days). | Sent only while an opt-in covers the record; Guard Cloud refuses a record whose basis is not in force and any excerpt with a recognised secret. Every read is audited; never exported to a SIEM. |