Security

PII Crawler scans all data locally and can be used in an air-gapped environment. Scan data is never sent remotely. A scan makes no network calls at all: the only requests the binary can make are license registration, the update check that piicrawler update performs when you run it, and a crash report — each listed below, and each one avoidable. This makes PII Crawler suitable for high-security or compliance-bound environments. The security page lists the same requests with their exact payloads.

Access Control

The scanner requires access only to the files it scans. It does not need root or other unnecessary system permissions. Users can choose exactly which folders or file types to scan, reducing accidental access to irrelevant data.

Files PII Crawler writes are readable by you only on Linux and macOS (mode 0600), and the folder they live in (~/.piicrawler) is 0700. That covers everything the product creates that carries what it found:

• the local database, ~/.piicrawler/piicrawler.db, which holds every finding from every scan;
• the CSV and HTML exports from the TUI, and export, report --out, dsar --report, scan --out and textextract --out on the command line;
• the key file that protects an encrypted quarantine, the quarantine folder itself, and every run folder and mirrored folder inside it (0700). A folder you point a run at that already exists is tightened to 0700 too, and the log says so: a quarantine keeps a file's own mode but not the protection of the folder it came from, so the holding folder has to supply it;
• a file put back by a restore, from the moment it starts being written.

The mode is set when a file is created rather than after it is written, so a large export is never briefly readable by others with the findings already in it, and overwriting an older, more permissive file tightens it. Copy one somewhere else and the copy keeps that mode. An installation made by an earlier version is tightened the next time PII Crawler opens its database.

Writing to something that is not a regular file — --out /dev/stdout, or a named pipe you have set up — leaves that destination's own permissions alone.

Web Interface Protection

The web interface listens only on your own machine (localhost) unless you explicitly configure it otherwise. To protect against DNS rebinding attacks, where a malicious website tricks your browser into sending requests to local applications, the server rejects any request whose Host header is not a localhost address. This happens automatically and requires no configuration. If you bind the interface to a network address so other machines can reach it, password protection is required and requests from any hostname are accepted.

That requirement is enforced everywhere the two halves of it can be set, because a network bind with no password would be both unauthenticated and without the Host check that a loopback bind relies on:

• piicrawler serve --bind <network address> refuses to start when no password is set, and prints the way back.
• Settings → Bind address refuses a network address until a password is set. localhost, 127.0.0.1 and ::1 are all this machine and need none.
• Settings → Remove password protection refuses while the running server, or the stored bind address, is a network one. Set the address back to 127.0.0.1 first.
• Settings → Delete All Data refuses while the running server is a network one, because the wipe clears the stored password along with everything else. Restart on 127.0.0.1 first. (It does not need to ask about the stored bind address, which the wipe clears back to 127.0.0.1 too.)
• piicrawler doctor reports the combination as a red ✗ rather than a green tick, so an installation configured this way by an older version is visible before the next start fails.

External Services & Data Sent

PII Crawler makes network requests in the following limited circumstances. Scan data, file contents, and PII findings are never transmitted.

License Registration

When you register your copy of PII Crawler, two form-encoded requests go to api.eligian.com:

• POST /email/register, carrying your email address, which starts the verification email;
• POST /product/register, carrying your email address, the product identifier (piicrawler), the operating system (e.g. linux, macos, windows) and the CPU architecture (e.g. x86_64, aarch64).

The second one is polled every few seconds while PII Crawler waits for you to click the link in the verification email, and the web UI's Refresh license button repeats it later. Nothing else in the product calls either endpoint.

Registration can be skipped entirely: an install that finds a valid license.lic in its app data directory registers from that file and makes no network call at all. See Deploying a license file.

Your registration is stored in the local database, and Settings → Delete All Data keeps it: the wipe is about the data an install has collected, so it does not deregister the install or send you back to the licensing server. Every other setting in that store — the web UI password among them — goes with the data.

Version Checking

piicrawler update fetches a small JSON manifest — piicrawler-cli-<platform>.json — from downloads.eligian.com, compares the build it names against the running one, and, if you confirm, downloads the archive and checks its SHA-256 before swapping the binary in. The request contains no user data.

Nothing checks for updates on its own. There is no probe at launch, no daily background check, and nothing in the terminal or web UI that reaches out. If you never run piicrawler update, this request never happens.

Error Reporting

If PII Crawler crashes, or fails fatally while starting up, it may send an error report. These reports go to Sentry (Functional Software, Inc., United States), the error-tracking service we use — not to Eligian's own servers. A report is a Sentry event and contains:

• the message and type of each error in the chain, and a stack trace when the report comes from a crash;
• the PII Crawler version;
• the machine's hostname;
• the operating system name, version and kernel version, and the CPU architecture;
• the on-disk path of the PII Crawler binary and of every shared library it had loaded, which on a normal install are paths under your home directory.

An error message can also name a file PII Crawler itself was opening — its database, its log file, a license file — and that path is sent as written. Paths of the files you scan, their contents, and anything a scan matched are never put into an error report.

Nothing is sent by a run that finishes.

Disabling crash reporting: set the SENTRY_DSN environment variable to an empty string (SENTRY_DSN="") before launching PII Crawler and no error reports are sent. That switches off error reporting and nothing else — it does not need to switch off anything else, because the update check only runs when you run piicrawler update and registration is covered by a license.lic file. See Crash reporting for details.

Analytics

There are none. Neither the command-line tool nor the web interface reports feature usage anywhere, and the web interface loads no third-party script — every asset it serves comes from the binary itself.