What the agent reads, and what it sends

The agent manages the firewall (iptables and ipset), reads the system's logs and network state, and applies the fixes you ask for. All of that needs root. It is one static Go binary with no dependencies, running as a service you can stop at any time.

Its firewall rules live in its own chains, named INFRAFENCE. It never edits your rules, and it never adds an accept rule of its own: the only accept rules are the ones you create from the dashboard. When another tool reloads the firewall (csf -r, a ufw or firewalld reload, iptables-restore), the agent puts its chains back.

Reading a file is not sending it. Everything in this table is analysed on the server; the next section lists what leaves it.

• Its own firewall chains and ipsets: bans, the allow list, country blocks, closed ports.
• Only when you turn on Allow web server configuration changes: its ModSecurity rules and user-agent blocking in nginx or Apache. It never edits a configuration that a hosting panel manages.
• Only when you, AutoMode or the emergency mode ask for it: hardening fixes, closed ports, outbound blocks, virtual patches, security updates and quarantined files.

Every change is checked afterwards and undone if SSH or a website stops answering. Monitor mode detects everything and blocks nothing, and one command uninstalls the agent and everything it added.

Everything goes to the dashboard over HTTPS:

• a regular heartbeat: agent version, address, system metrics (CPU, memory, disk, load, network), listening services and ports, the web server and the domains it serves, firewall counters;
• security events: the attacker's address, the type and time of the attack, and the details needed to understand it: for a web attack the single log line that triggered it, for malware the file path and the matched text;
• the list of installed packages, for the vulnerability check;
• the SHA-256 hash of scanned PHP files, to look them up among known malware.

Full logs and files never leave the server. There is no telemetry, and nothing is shared with third parties, with one exception: the AI features. When you ask for an AI analysis, use the assistant or draft a report, and while AutoMode or the emergency mode is on, the events needed are sent to Anthropic to produce the answer. The dashboard says so before you send anything. The instant analysis, on every plan, sends nothing anywhere.

• The install token is single-use and valid for one hour.
• The agent's own token is kept in /etc/infrafence/config.json, readable only by root. The dashboard stores only a hash of it, so a copy of the dashboard's database holds no usable agent token.
• Changes made in the dashboard reach the agent through a channel that only tells it to synchronise. The agent then fetches its configuration over HTTPS with its own token: a message on that channel is never treated as an instruction.
• Passwords are stored only as hashes. New passwords are checked against known breaches (Have I Been Pwned) with only the first 5 characters of their SHA-1 hash leaving your browser.
• Two-factor authentication (TOTP) is available to every user. Once it is on, the database itself refuses the organization's data to a session that has not passed the code step. Approving an AutoMode action needs a 2FA session.

Every release is built by GitHub Actions from the public repository, signed with Cosign and published with build provenance. The agent installs an update only from the official GitHub releases, and only if its checksum and its signature verify against the public key built into the agent.

To check the binary on your server yourself, compare its checksum with the release's:

curl -sL https://github.com/infrafence/infrafence-agent/releases/latest/download/checksums.txt
sha256sum /usr/local/bin/infrafence-agent

Verify its Cosign signature:

cosign verify-blob \
  --key https://raw.githubusercontent.com/infrafence/infrafence-agent/main/cosign.pub \
  --signature https://github.com/infrafence/infrafence-agent/releases/latest/download/infrafence-agent-linux-amd64.sig \
  /usr/local/bin/infrafence-agent

And its build provenance, with the GitHub CLI:

gh attestation verify infrafence-agent-linux-amd64 --repo infrafence/infrafence-agent

For an older version, replace latest/download with download/v<version>. The container image and the Helm chart are signed too: see SECURITY.md.

The agent is source-available under the Business Source License 1.1. You can read and audit every line before you install it. Production use is free on any number of servers, your customers' servers included, as long as you don't use it to offer a competing product. Four years after each version is published, that version becomes available under the Apache License 2.0.

• HTTPS only, with HSTS for two years on infrafence.com and every subdomain.
• A strict Content Security Policy: scripts only from our own domain, each one carrying a per-request nonce, and no framing by other sites.
• Fonts served from our own domain. Analytics or advertising cookies are set only if you accept them in the cookie banner; without consent there are none.

The dashboard and its database run on servers of Contabo GmbH in Germany, in the European Union. Stripe, for payments, and the AI provider, when you use the AI features, may process data outside the EU under the European Commission's Standard Contractual Clauses or an adequacy decision. We never sell or rent personal data.

The Privacy Policy lists every recipient and how long each kind of data is kept.

The agent never needs the dashboard to protect the server: detection, bans and blocks all run on the server. Network errors, timeouts, DNS failures and server errors are never treated as a refusal, so protection stays on for as long as an outage lasts. Bans, the allow list, country blocks and closed ports stay in force, new attacks are still blocked, and events wait in a queue until the dashboard answers again.

A refusal is different: the dashboard refuses an agent whose token was revoked, whose organization is suspended, or that is beyond its plan's server limit, for example after a cancellation or an unpaid invoice.

1. For the first 24 hours local protection stays in force, and the agent keeps asking again.
2. After 24 hours of refusal without a single successful answer, the agent switches its protection off cleanly: its firewall chains and ipsets, its web server rules and its malware watcher go, and detection continues in monitor mode only. Other tools' rules are never touched.
3. Where the system supports it, a login notice says that InfraFence no longer protects the server.
4. The agent keeps asking every 30 minutes. At the first successful answer, protection comes back on and the notice is removed.

The account's owners get an email 12 hours before the switch-off, at the switch-off, and when access is restored.

Write to info@infrafence.com, the contact in our security.txt. Please don't open a public GitHub issue. Include the steps to reproduce if you can. We answer within 48 hours, and with your permission we credit you in the release notes. The full policy is in SECURITY.md.