Data & controls
Your network data, and who can read it.
What ShadowLatch records, how it's protected, and the controls your team has over it.
A plain-language product guide. The full terms are in our Privacy Policy.
What we record
Connection details, not content.
For each connection the agent can record the device, the application's path and hash, the Windows user, the time, the remote address, port and protocol, the DNS name where one is available, the amount of data sent and received, and whether it was allowed or blocked. DNS lookups are recorded as names, never the page or the content behind them. When a content category applies, only the label leaves the device, never the domain it was matched against. On a server with intruder blocking on, a blocked address is recorded with the reason and the time; the user name that was tried is not.
ShadowLatch doesn't capture packets, read file contents or decrypt HTTPS. Even so, this is sensitive: a path can contain a person's name and a hostname can reveal an internal service. That's why the most revealing fields are end-to-end encrypted.
A record is evidence of what the agent saw, with limits. An allowed attempt isn't proof the server answered, and a missing record isn't proof nothing happened.
Encryption
End-to-end encrypted, so only your team can read it.
Customer telemetry is end-to-end encrypted. Sensitive fields are encrypted on your device before they're uploaded and decrypted only in your administrators' browsers. ShadowLatch's servers store and move the encrypted data but hold no key that can open it: nobody at ShadowLatch can read who ran what, or where, unless one of your administrators unlocks it. A full compromise of our servers wouldn't expose it.
- Your keys stay with you
- Your organization has its own encryption key. It's never stored in readable form on our servers: each administrator holds a wrapped copy that only they can open, after signing in with MFA. ShadowLatch has no master key and no back door.
- As strict as you want
- The owner picks one of three protection levels, the same three described on the Security page. Second factor (the default) shows names only after an administrator confirms a second factor: any passkey they hold, including one synced through Apple, Google or a password manager, or their sign-in password after signing in with their authenticator code or passkey. Hardware-bound allows only device-bound passkeys such as Windows Hello on approved computers, so the key lives in a security chip and a stolen session can't open it. Passphrase adds a passphrase of at least 14 characters with a special character, typed in the browser: nothing to set up and the quickest start, but a guessed or phished passphrase would open your data. A password alone never opens the data. Each person can hold several keys, and a lost or stolen one can be revoked immediately.
- Recovery is yours too
- When you turn on encryption you save a recovery kit, and a second administrator can approve a replacement workstation. Because ShadowLatch never holds a working key, if every key and the recovery kit are lost the encrypted data can't be recovered, by you or by us; the owner can then reset protected data and start again with a new key.
| End-to-end encrypted | Readable by the service |
|---|---|
| Application paths and process names, command lines, Windows user names, hostnames and DNS names, local addresses, the names of your devices, groups, companies and policy groups, device notes, the comments administrators leave in the audit log, and any other free-form text | Remote IP address, port and protocol, allowed or blocked, bytes sent and received, and timestamps. The service needs these to draw Flow, find new destinations for Review, and look up owners and locations. Accounts that want even remote addresses encrypted can turn on Maximum privacy and give up those three features. Also readable: your account's email, name and billing details, and what a policy targets (the site, address or application typed into it), because the service compiles and signs policies for your devices. |
How it works in practice: when you create your account's encryption key in the console, each device pins it and encrypts everything in the left column to it before upload. A device that has no key yet holds its records locally rather than sending them readable, and the service refuses any upload that isn't encrypted. Names appear in the console only after an administrator unlocks, with a passkey, a sign-in password on a browser where they signed in with their second factor, or a passphrase, depending on your protection level; everywhere else they show as protected. Names your administrators type (a device, group or policy group name, a note, an audit comment) are sealed to the same key in the browser before they're sent, even while protected data is locked. Telemetry recorded before the switch-over was deleted rather than converted. Questions: support@shadowlatch.com.
All traffic between devices, browsers and ShadowLatch uses HTTPS.
Who can see it
Only the people your team lets in.
Records are visible to users of your ShadowLatch account, according to their role: owner, admin, analyst or viewer. Owners can require MFA for every administrator, lock a user, sign them out everywhere or remove them. Sensitive changes ask for MFA again, and changes to policies, devices and users are recorded in the audit log.
ShadowLatch is an administration tool. Enroll only devices you're authorized to monitor, and give the notices your environment requires. If your device is managed by an organization, ask its administrator about monitoring and retention.
IP details
Owner and location lookups are optional.
With IP details turned on, ShadowLatch looks up the network owner and approximate location of public addresses, so 8.8.4.4 appears as Google instead of a bare number. The lookup sends the address, and nothing else, to an external provider, and results are cached. You can turn it off in Settings at any time.
An owner and location are context. They aren't proof that a destination is safe, or where the server physically is.
How long it's kept
History follows your plan.
Connection history is kept for 30 days on Core, 90 days on Control and 180 days on Complete. Older records are removed on a rolling basis, and choosing a longer date range can't bring them back.
Devices hold a short local queue of records until they're uploaded. Uninstalling the agent doesn't delete history already in the cloud; removing the device in Manage does. To delete your account, use the Account page or email support. Encrypted backups are kept for 30 days, so deleted data leaves them within 30 days.
Beta requests
What the beta form keeps.
When you request beta access we store what you enter on the form, plus the time, your IP address and browser type to stop abuse. We use it only to review your request and contact you about the beta, and we email you to confirm it arrived. To have a request deleted, email support.
Website storage
What this website remembers.
- Appearance
shadow_ui_themein local storage remembers light or dark mode. It’s shared with Manage, so the website follows the theme you pick there.- Account session
shadow_store_authin session storage keeps you signed in on this website until the tab closes, you sign out or the session expires. In Manage, theshadow_refresh_tokencookie keeps you signed in for up to 14 days unless you sign out.- Trusted browser
- If you tick "remember this browser" when entering a sign-in code, the
shadow_trusted_browsercookie skips the code on this browser for the time your account owner allows. You can forget it in Settings at any time. - Payments
- When paid plans open, checkout happens on our payment provider's site under its own privacy terms.
This website uses no advertising or tracking cookies. Clearing browser storage resets these preferences or signs you out; it doesn't delete your account.
Questions
Talk to a person.
Email support@shadowlatch.com with questions about your data. Include the product version if it's about a device. Never send passwords, access tokens, enrollment tokens or recovery kits.