How it works & privacy

Docs

Dazio runs on your machine. Scanning, the component inventory, the secrets and misconfigurations it finds, and your scan results all stay local.

The malware feed also lives on your machine, as a copy that Dazio refreshes every hour while the feed is on. Every package check runs against that local copy, so no package name is sent anywhere to be checked. That includes the checks safe-pkg runs at install time, through a local registry and a local HTTPS proxy. The proxy’s certificate authority never enters your system trust store.

    flowchart LR
  subgraph machine["Your machine"]
    cli["dazio CLI"] <--> daemon["Background daemon"]
    daemon --> feed[("Local feed copy")]
    pm["Package managers"] --> proxy["safe-pkg local registry"] --> feed
  end
  daemon <-- "registration, feed updates, analytics if on" --> backend["Dazio backend"]
  cli -- "update check" --> backend

What leaves the machine

With analytics on, Dazio reports counts of what the scan finds and, on a malware match, the threat and the package name and version, tied to this installation. It also reports errors as a class, an operation name and the failure’s type, never a message, and that dazio feed enable turned analytics on, when it did. It never sends file contents, paths, your package inventory or secrets.

A malware match is any time the feed matches a package on your machine: one a scan finds on disk, one safe-pkg warns about or blocks at install, or one you let through with dazio safe-pkg allow. A match that later goes away is reported too.

Analytics is on by default. The malware feed needs it, so turning analytics off also switches the feed off and stops its hourly updates. The guided first scan sends no analytics.

Whatever the analytics setting:

Registration. To download the feed, the installation registers once, on the first scan or when the daemon first starts, and receives a token. Registration sends the OS, the CPU architecture and the Dazio version.
The first-scan snapshot. If you accept the feed terms, the guided first scan downloads one feed snapshot with that token. Hourly updates after it need the feed on, and so analytics.
Update check. The CLI checks for a newer release at most every 15 minutes once Dazio’s state folder exists; before that, on every command. The request is an anonymous GET /v1/version that asks for the latest release: no token, no body, and not even the installed Dazio version. To turn it off, set DAZIO_NO_UPDATE_CHECK=1.
Your email address, only if you give one to dazio feed enable or dazio protect. It is used to confirm the address and to send malware alerts. dazio email unbind drops it, and dazio email erase asks for it to be erased.

As with any network request, the backend sees the IP address that connects to it.

dazio scan --local scans in-process and sends nothing, including registration and the update check.

Turning analytics off

There is no dazio command to turn analytics off yet. Set it in settings.json in the Dazio state directory instead:

macOS: ~/Library/Application Support/dazio/settings.json
Linux: ~/.config/dazio/settings.json (or $XDG_CONFIG_HOME/dazio/)

Set the analytics key to off, and keep the other keys. If the file does not exist, create it with:

{"analytics": "off"}

Then restart the daemon, which reads the setting only when it starts:

dazio service restart

DO_NOT_TRACK=1 also turns analytics off, but only for the process that sees it: a dazio command, or a daemon started from that shell. The daemon that starts at login does not read your shell’s environment, so exporting DO_NOT_TRACK in your shell profile does not stop its uploads. Use settings.json for that.

To stop everything, first run dazio reset --yes while the daemon is still running: it unregisters this installation and deletes any uploads that have not been sent yet. Then dazio service uninstall removes the daemon.

CLI & config reference Uninstall