Privacy Notice
How SYSMarshal collects, uses and protects information: what stays on your server, what the software sends to us, what we share with the global threat feed and other services, and the rights you have.
Stays on your server
- Your Windows event logs. They are read where they are and never uploaded in bulk.
- The local SYSMarshal database: Recent Activity, investigations, evidence and artifacts.
- Reports and telemetry files written to the
Reportsfolder. - Your sign-in password. Only a one-way hash is kept, on the machine itself.
Sent to SYSMarshal
- Licence checks: your licence key, a hardware ID and the computer name.
- Detected attackers: the attacker’s IP, location and the event that caught it.
- Error and install reports, so we can fix problems on your machine.
- AI requests, only when you use an AI feature.
Never shared
- Your computer names, internal IP addresses or account are never shown to other customers.
- We do not sell personal information.
- Nothing is submitted to the FBI or IC3 on your behalf. You file those reports yourself.
1Who we are and what this covers
SYSMarshal is made by SYSDBA Inc. (“SYSMarshal”, “we”, “us”). We are the controller for the personal information described here.
This notice covers:
- the website and store at sysmarshal.com, including your account, orders and support tickets;
- the SYSMarshal desktop application, the SYSMarshal protection service and the installer (“the software”);
- the SYSMarshal cloud services the software connects to: licensing, the shared threat feed, IP reputation, AI features, updates and in-app help.
SYSMarshal is business software. When you install it on a server, your organisation decides what that server monitors. For the security data the software processes on your machines, your organisation is responsible for its own use of it, and we process what reaches our services as described below.
How you may use the software is governed by our Terms of Service & End User License Agreement.
2Information that stays on your server
Most of what SYSMarshal works with never leaves the machine it protects:
- Windows event logs. The software reads security events, such as failed sign-ins and blocked connections, locally to detect attacks. It does not upload your event logs.
- The local database. Recent Activity, your whitelist and trusted lists, investigation cases, evidence and artifacts (for example saved AI answers and PowerShell output) are stored in a SQL Server Express instance on your machine.
- Reports. Diagnostic, telemetry and FBI/IC3 complaint packages are written to the
Reportsfolder in the installation directory. - Your sign-in password. Only a one-way hash is stored, in the machine’s protected registry. We never receive it.
- Geolocation of attackers. Country and city lookups for attacking IP addresses use an offline database installed with the software.
This information stays under your control. Except as described in sections 3 to 6, it reaches us only if you choose to send it, for example by attaching a file to a support ticket.
3Information the software sends to us
To work, the software talks to the SYSMarshal cloud. This is what it sends, and why:
| What | What is sent | Why |
|---|---|---|
| Licensing and activation | Your licence key (encrypted), a hardware identifier (the machine’s BIOS serial number), the computer name and when the licence was last used. | To validate your licence, bind it to a machine, show your expiry date and stop a key being used on more machines than it covers. |
| Detected attackers | For each attacking IP the software blocks: the attacker’s IP address, its approximate location (country, city, postcode, coordinates), the Windows event ID that detected it, ports, protocol, direction and time. With it, the computer name and internal IP address of your machine that detected it. | To build your organisation’s shared blocklist (“Site data”) and the global threat feed. See section 4. |
| Your whitelist | IP addresses you add to the shared whitelist. | So every machine on your licence trusts the same addresses. |
| IP reputation checks | An attacker’s IP address. | To return its abuse confidence score. |
| Error reports | The error message and technical details (exception type and stack trace), the product and version, the Windows version, the computer name, the hardware identifier and the machine’s internal IP address. Passwords, connection strings, API keys and tokens are removed on your machine before the report is sent. | To find and fix faults on customer installs without asking you for log files. |
| Installation reports | Whether an install, update, repair or uninstall succeeded, failed (and at which step) or was cancelled. The versions involved, the computer name, the hardware identifier, the Windows user name that ran the installer, the internal IP address, the Windows edition and build, processor count, memory, free disk space, the installation folder and how long it took. | To support installations and see which versions are in use. |
| Updates and help | Ordinary web requests to sysmarshal.com for the latest version number, update packages and in-app help pages. | To keep the software current and show help. |
Like any web service, our servers also see the public IP address each request comes from. We use it to secure the service, for example to lock out repeated invalid licence keys.
4The shared threat feed
The value of SYSMarshal grows with every attack it sees. Attack data reported by the software is stored centrally and used in two ways:
- Site data. Every machine on your organisation’s licence shares one blocklist. Your own administrators can see which of your machines detected each attacker.
- Global data. Professional customers can also see attackers reported by all SYSMarshal customers worldwide. Global data shows the attacker side only: the attacker’s IP address, location, ports, event type, time and confidence score.
Other customers never see who reported an attacker. Your computer names, internal IP addresses and account are removed before global data is delivered.
Central attack data is also analysed, including with AI, to improve confidence scores and protection for all customers. Attack data is about the attacker: the IP address that tried to break in. IP addresses can be personal data in some jurisdictions. We process attackers’ addresses for network and information security, which is a recognised legitimate interest.
5AI features
AI features are optional, available on Professional licences, and only run when you start them. These include the AI Assistant and its DefCon forensic scans, AI analysis in Data Explorer, and script explanation in the Terminal.
When you use one, we receive the request and pass it to OpenAI, our AI provider, to generate the answer. What is sent depends on the feature:
- Chat: your message and any files you attach.
- DefCon scans: the telemetry the scan collects from the machine. Depending on the scan, this can include system configuration, running processes and services, scheduled tasks, network connections, installed software, security settings, event log entries and the user account names that appear in them.
- Data Explorer: the Recent Activity rows you choose to analyse, such as attacker IPs, events, ports, locations and times.
- Terminal: the PowerShell script you ask about.
We also record how much AI balance each request uses, so we can bill it. Before you run an AI scan on a sensitive system, check that sending this telemetry fits your organisation’s policies.
AI output can be wrong. Treat it as an analyst’s draft and check it before you act on it.
6Reports and lookups with other services
AbuseIPDB
SYSMarshal reports attacking IP addresses to AbuseIPDB, a community abuse database. Reports come from two places: our cloud reports attackers detected by the software, and you can report an attacker yourself from the blacklist dialogs.
A report contains the attacker’s IP address, the abuse categories (for example “Brute-Force”) and a short comment describing the attack, built from the event, ports and times. The comment never names your computer, your users or your domain. When you report manually you can read and edit the comment first, or untick reporting.
FBI / IC3
The “Report to FBI” assistant prepares complaint text for the FBI’s Internet Crime Complaint Center (IC3) from your local data. It sends nothing to the FBI. You copy the text into the IC3 website and submit it yourself, under IC3’s own privacy terms.
Lookups about attackers
To tell you who owns an attacking address, the software may look up that IP address with an internet registry (RDAP, for example ARIN) and with reverse DNS, and may check it against AbuseIPDB. Map previews of attacker locations may be loaded from Google Maps. These lookups send the attacker’s address or coordinates, and, like any web request, your machine’s public IP address. They do not send anything else about your machine.
7Our website and store
- Account: your name, email address, company details and a hashed password.
- Orders and licences: the products you buy, billing name and address, phone number, order history, licence keys and their expiry dates, and your AI balance.
- Payments: handled by the payment provider you choose at checkout. Your card or wallet details go to that provider. We receive a confirmation, not your full card number.
- Support: the tickets you open, your messages and any attachments.
- Email: we send order, licence, support and password-recovery emails to the address on your account.
- Password recovery: to send you a machine’s recovery code, we match the machines on your licences with your account. The code is emailed to you, never shown in the browser.
- Server logs: your IP address, browser, the pages you request and when. We use them to run and secure the site.
9Why we use information, and our legal bases
We use information to provide and license the software, run the threat feed, deliver AI features you request, process orders and payments, provide support, keep our services secure, fix faults and improve the product.
Where the GDPR or a similar law applies, our legal bases are:
- Contract: licensing, orders, AI features and support you ask for.
- Legitimate interests: network and information security, the shared threat feed, abuse reporting, fraud prevention, error and install reporting, and improving our products. We weigh these interests against your rights.
- Consent: analytics cookies, where the law requires consent.
- Legal obligation: tax and accounting records, and responding to lawful requests.
11Where information is processed
SYSMarshal is based in the United States, and our services and providers may process information there and in other countries. Where the law requires it, we use appropriate safeguards for international transfers.
12How long we keep it
- Account, order and licence records: while your account or licence is active, and afterwards for as long as tax, accounting and legal obligations require.
- Attack data in the threat feed: for as long as it is useful for protection. Records about attackers are threat intelligence and are not tied to your account in global data.
- Error and installation reports: for as long as they help us support the software. Repeats of the same error are counted rather than stored again.
- Support tickets: for as long as needed to resolve your request and keep a record of it.
- Data on your own server: stays on that machine, under your control, until you delete it.
13How we protect it
Connections between the software, our website and our cloud services are encrypted with HTTPS. Licence keys are stored and sent encrypted, passwords are stored only as one-way hashes, and error reports are stripped of credentials before they leave your machine.
No system is perfectly secure. If you believe you have found a security issue in SYSMarshal, please email support@sysmarshal.com.
14Your rights
Depending on where you live, you may have the right to:
- know what personal information we hold about you and get a copy of it;
- have it corrected or deleted;
- receive it in a portable format;
- object to, or ask us to restrict, how we use it;
- withdraw consent where we rely on consent;
- not be treated differently for exercising these rights.
Residents of California and other US states with privacy laws have these rights under those laws. Residents of the EU, EEA and UK have them under the GDPR and may also complain to their local data protection authority.
To make a request, email support@sysmarshal.com from the address on your account, or open a support ticket. We will verify your identity before acting, and reply within the time the law allows. Some information, such as licence records, is needed to keep your licences working, so deleting it may end them.
15Children
SYSMarshal is business software. It is not directed at children, and we do not knowingly collect personal information from anyone under 16.
16Changes to this notice
We will update this notice when our practices change, and change the effective date at the top. For significant changes we may also tell you by email.
17Contact us
SYSDBA Inc. (SYSMarshal)
Email: support@sysmarshal.com
Support: sysmarshal.com/supportticket/mytickets