Trust Center
Security and data-handling overview for IT, procurement, and compliance review. Last updated: July 2026 (train v1.8.9).
StacksAtlas is an on-premise network monitoring appliance. Discovery, inventory, security grades, and alerts stay on hardware you control. This page summarizes how we protect data and how the product is built. For the founder story, see About. For binding legal terms see our Privacy Policy and Terms of Service.
Executive summary
StacksAtlas does not operate a multi-tenant cloud that ingests your network map. The appliance runs on Windows, macOS, or Linux (Docker) at your site. Optional Business features add always-on service, Hub fleet federation, alerts, and SSO — still without uploading device lists to StacksAtlas LLC.
Data handling & residency
- Network inventory — stored only in the local appliance database (LiteDB on Nodes; Hub fleet store on the Hub host).
- No product telemetry — we do not collect usage analytics, crash dumps with inventory, or MAC/device lists from your installs.
- Business license activation — one-time handshake with Lemon Squeezy (license key + hardware ID hash). No subnet or device payload.
- Operator-controlled exports — CSV, PDF, and backups are files you download and secure.
Encryption
- Database — LiteDB encrypted at rest (AES-GCM). Keys supplied via platform environment on Unix; Windows uses protected storage paths.
- TLS — self-signed appliance CA for HTTPS on port 5001. First launch is HTTP-first (no certificate warning); operators opt in to trust the local CA.
- Passwords — local accounts use PBKDF2 hashing. SSO passwords are not stored when using OIDC/LDAP.
- API tokens — long-lived
sa_integration keys are stored as SHA-256 hashes; the raw token is shown once at creation.
Access control
Role-based access (Admin, Standard, Viewer, Alert Only) gates settings, scans, and exports. Business deployments support OIDC (Entra ID, Okta, Google Workspace, etc.) and LDAP/LDAPS with group-to-role mapping. API access uses JWT (7-day default) or revocable sa_ tokens for automation.
Network architecture
The REST API and UI listen on your LAN (default HTTP 5000 / HTTPS 5001; macOS 5050). Hub federation uses outbound SignalR from enrolled Nodes — remote sites initiate connections; you do not expose Node databases to the public internet. Optional Tailscale enrollment keeps traffic on your overlay network.
Federation architectureSupply chain integrity
- Windows — Authenticode-signed MSI and portable builds (STACKSATLAS LLC).
- macOS — Developer ID signed and notarized DMG.
- Updates — Ed25519-signed release manifest; in-appliance verification before apply.
- Build gates — npm high-severity audit in CI;
security-audit.ps1for pre-release static and dependency checks.
Vulnerability management
Dependabot monitors GitHub dependencies. Release builds fail on high/critical npm findings. Operators can run pwsh ./scripts/security-audit.ps1 -Strict before promote. Critical CVE patches ship on the release-v1.8.x patch train.
Logging & audit
Operational logs (Serilog), discovery System Events, and optional syslog/SIEM export (Business) remain separate from the audit log (v1.8.9+): an append-only record of who logged in, changed users/settings, managed federation, or altered device governance. Admin-only API and UI at /audit (labeled Audit Log). Federated nodes push rows to the Hub. When syslog is enabled, rows are also forwarded to your SIEM. Events are retained with the local database (no automatic purge; removed only by factory reset or intentional wipe). Secrets are never stored in the log.
Subprocessors & open source
- Lemon Squeezy — Merchant of Record for Business license purchases (payment data handled by Lemon Squeezy, not StacksAtlas LLC).
- IEEE MA-L/OUI — embedded public registry data for MAC vendor lookup (on-appliance only).
- OpenAVC (optional) — separate MIT-licensed control platform; not bundled with StacksAtlas.
Responsible disclosure
Report suspected vulnerabilities to admin@stacksatlas.com. Include version, platform, and reproduction steps. We respond to good-faith reports without legal action for good-faith research on your own appliances.