Each detection sends only what is listed below, plus any context you switch on. This page shows what leaves, what stays, and where our limits are. We hold no SOC 2 or ISO 27001 certificate; details are in security measures.
A handful of rules guide the design, from the es-python runtime on your machine to the dashboard that shows your events.
EyalSec is designed so your code and data stay local. What travels to your dashboard is the detection event, plus any context you choose to attach to it. The user guide lists exactly what an event carries and how values that look like secrets are masked.
It is the same Python you already use. The protection is off until you turn it on, and you choose whether it watches quietly or steps in.
Out of the box it behaves exactly like standard Python. You opt in to the protection you want.
It keeps track of data from risky sources and notices when that data reaches a sensitive operation.
In observe mode it reports the finding to your dashboard. In active mode it can stop the action before it runs. See Report and Raise.
No single control is trusted on its own. Each layer below assumes the others might fail.
Your files stay on the machine, and source code is sent only if you turn it on. Only detection events, with the context you choose, reach the dashboard.
Every connection is encrypted with modern TLS, and an access-control list can limit which addresses reach your dashboard and API.
Each machine carries its own credential. There is no shared master key in any binary, so one compromised machine cannot expose the rest, and any credential can be revoked.
Dashboard sign-in supports optional two-factor auth, API keys are stored only as hashes, and every permission is enforced on the server, never just hidden in the page.
Passwords are stored with bcrypt, keys are kept as hashes, server secrets live in managed storage, and each machine’s configuration is encrypted just for it.
The es-python runtime we ship is stripped and checked for tampering, and no shared secret is baked into it.
Getting EyalSec onto a machine is itself part of the security model.
Each install uses a one-time, time-limited token tied to a specific machine and owner. See installing es-python.
The interpreter is delivered over HTTPS and checked against a known checksum before it is unpacked.
Its unique credential is fitted at install time, so two machines never share an identity.
Each event sends which check fired, the stack trace, where the data came from, the specific value that triggered the check and, by default, the command line that started the program. Your project files, your source code and the rest of the data your program handles stay on the machine. Environment variables and two short source listings per event are sent only if you switch them on.
Values whose names look like secrets, such as passwords, tokens, keys and the password part of a URL, are replaced with [masked] on the machine before an event is sent, and masked again on arrival. Masking goes by name, so a secret stored under an ordinary name is not masked, and source listings are sent as they are. The user guide page on event context lists the exact rules.
The EyalSec service runs on Amazon Web Services in the il-central-1 (Israel) region, on a single hosted instance, and your account data and events are stored there. Israel benefits from an EU adequacy decision, so personal data can flow from the EEA to the service without additional transfer safeguards. There is no multi-region failover and no contractual uptime commitment unless one is agreed in a signed order.
No: EyalSec holds no SOC 2 or ISO 27001 certificate today, and says so here rather than implying one. What it does publish is the full list of security measures, the sub-processors it uses, a data processing agreement and a coordinated vulnerability disclosure policy with a safe harbour for good-faith research. For anything a questionnaire needs beyond those pages, write to sales@eyalsec.com.
In Report mode, no: your program runs exactly as it would without EyalSec, and es-python only records events. Behaviour changes only when you add a Raise rule, which stops the named operation by raising a Python RuntimeError at that point, and Raise must first be enabled for your account. Going back is running your program with python again; nothing in your code was changed.
Email security@eyalsec.com with the details and the steps to reproduce, and give EyalSec a reasonable chance to investigate and fix the issue before you publish it. The vulnerability disclosure policy commits to an acknowledgement within 3 business days and an initial assessment within 10, and sets out the safe harbour that protects good-faith research.
We welcome reports from security researchers acting in good faith. If you believe you have found a vulnerability, email security@eyalsec.com with the details and steps to reproduce.
Please give us a reasonable chance to investigate and fix the issue before disclosing it publicly. Our disclosure program sets out what is in scope, our response times and the safe harbour that protects good-faith research. To encrypt your report, use our OpenPGP key; the same details are in our signed security.txt.
Researchers who report a valid issue are thanked, if they wish, in our hall of fame, and EyalSec’s own security advisories are listed in one place. Our full security measures are published too.