How it works & privacy

Docs

Dazio runs on your machine. Scanning, the secrets and misconfigurations it finds, and your scan results all stay local.

Malware checks run in two steps. Dazio first checks each package against a copy of the malware feed on your machine, which it refreshes every hour while the feed is on. A package that copy does not match is then sent to Dazio’s malware lookup, which checks it against sources whose data cannot be copied to your machine. That covers the checks safe-pkg runs at install time, through a local registry and a local HTTPS proxy, too. The proxy’s certificate authority never enters your system trust store.

    flowchart LR
  subgraph machine["Your machine"]
    cli["dazio CLI"] <--> daemon["Background daemon"]
    daemon --> feed[("Local feed copy")]
    pm["Package managers"] --> proxy["safe-pkg local registry"] --> feed
  end
  daemon <-- "registration, feed updates, malware lookups, analytics if on" --> backend["Dazio backend"]
  cli -- "update check" --> backend

What leaves the machine

With analytics on, Dazio reports counts of what the scan finds and, on a malware match, the threat and the package name and version, tied to this installation. It also reports errors as a class, an operation name and the failure’s type, never a message, and that dazio feed enable turned analytics on, when it did. Analytics never sends file contents, paths, your package inventory or secrets.

A malware match is any time the feed matches a package on your machine: one a scan finds on disk, one safe-pkg warns about or blocks at install, or one you let through with dazio safe-pkg allow. A match that later goes away is reported too.

Analytics is on by default. The malware feed needs it, so turning analytics off also switches the feed off: its hourly updates and its malware lookups stop. The guided first scan sends no analytics.

The malware lookup. For each package the local feed copy does not match, Dazio sends its ecosystem, name and version with the installation’s token, never a path or a file, and gets back only the packages that match. The backend does not log or store what it is asked. Dazio caches each answer on your machine and asks about a package again only when the lookup’s data for that ecosystem changes, and then mostly for packages installed in the last 14 days. It asks:

at install, about each package safe-pkg checks, while the feed is on;
in background scans, about the packages on disk, while the feed is on;
in the guided first scan, once, after you accept the feed terms.

When the lookup does not answer in time, the package is checked against the local copy only, and the result says it was not fully checked. An install goes ahead after 5 seconds.

Whatever the analytics setting:

Registration. To download the feed, the installation registers once, on the first scan or when the daemon first starts, and receives a token. Registration sends the OS, the CPU architecture and the Dazio version.
The first-scan snapshot. If you accept the feed terms, the guided first scan downloads one feed snapshot with that token. Hourly updates after it need the feed on, and so analytics.
Update check. The CLI checks for a newer release at most every 15 minutes once Dazio’s state folder exists; before that, on every command. The request is an anonymous GET /v1/version that asks for the latest release: no token, no body, and not even the installed Dazio version. To turn it off, set DAZIO_NO_UPDATE_CHECK=1.
Your email address, only if you give one to dazio feed enable or dazio protect. It is used to confirm the address and to send malware alerts. dazio email unbind drops it, and dazio email erase asks for it to be erased.

As with any network request, the backend sees the IP address that connects to it.

dazio scan --local scans in-process and sends nothing, including registration, the malware lookup and the update check.

Turning analytics off

There is no dazio command to turn analytics off yet. Set it in settings.json in the Dazio state directory instead:

macOS: ~/Library/Application Support/dazio/settings.json
Linux: ~/.config/dazio/settings.json (or $XDG_CONFIG_HOME/dazio/)
Windows: %LOCALAPPDATA%\dazio\settings.json

Set the analytics key to off, and keep the other keys. If the file does not exist, create it with:

{"analytics": "off"}

Then restart the daemon, which reads the setting only when it starts:

dazio service restart

DO_NOT_TRACK=1 also turns analytics off, but only for the process that sees it: a dazio command, or a daemon started from that shell. The daemon that starts at login does not read your shell’s environment, so exporting DO_NOT_TRACK in your shell profile does not stop its uploads. Use settings.json for that.

To stop everything, first run dazio reset --yes while the daemon is still running: it unregisters this installation and deletes any uploads that have not been sent yet. Then dazio service uninstall removes the daemon.

CLI & config reference Uninstall