Data Protection & Infrastructure

Security and data handling

A-Packets analyzes network packet captures for incident response, forensics, and protocol inspection. This page describes how uploaded files are isolated and retained, our cloud sub-processors, and self-hosted options when traffic cannot leave your perimeter.

File Lifecycle

What happens to your uploaded file

The retention schedule and report visibility depend directly on the analysis mode selected when submitting the capture.

Public Analysis ≤ 25 MB

No account required

The result page is public. Use this path only for captures you can share publicly; choose a private plan for confidential traffic.

Retention Window

Files are automatically deleted from active systems at least once every 24 hours (often sooner).

Private: Credit Pack Pay as you go

Confidential one-off runs

Captures are processed in isolated storage, are not shared with other users, and never enter the public result feed.

Retention Window

Reports are kept for 30 days from analysis, then deleted automatically. Download the report before that window ends, or upgrade to a subscription for permanent private storage.

Private: Subscription Recurring

Ongoing private analysis

Private analyses do not appear in the public feed. You manage your stored files and delete them from your account.

Retention Window

Permanent private storage, with deletion under your control. Account data may also be retained as needed to operate the service and meet legal obligations.

Before uploading: Public analysis shares everything recorded in the PCAP, including the file itself. Review the capture contents before uploading, or choose private analysis for sensitive traffic.

Manual deletion: Private reports can be deleted at any time through your dashboard. Public analyses can be removed upon request using our contact form. For complete legal retention terms, refer to our privacy policy.

Architecture

Processing and infrastructure safeguards

Technical controls applied to safeguard packet captures, metadata, and user accounts.

Encryption in transit and at rest

We use encryption in transit and at rest, as described in our privacy policy. Private captures are processed in isolated storage and are not shared with other users.

Access controls and network defense

Access controls, firewalls, and regular monitoring protect the service. Access to stored personal information is restricted to authorized personnel.

Physical data storage locations

Uploaded PCAP files and related data are stored using AWS S3, currently in the United States, and MongoDB Atlas. The database region depends on the selected cluster and may include the United States.

Diagnostic and security logging

Diagnostic and security logs may be retained for a limited period for security, fraud prevention, and compliance. These are operational records, not a customer-facing audit log.

Compliance & Vendors

Sub-processors and international transfers

How data processing responsibilities are structured under applicable privacy frameworks.

Controller vs Processor roles

Under the GDPR, A-Packets is the controller for account management, billing, support, and service operations. For data uploaded by business customers, we generally act as a processor under their instructions and our data processing terms. The business customer remains the controller.

Core sub-processors

We rely on primary cloud providers to deliver core platform services:

  • Amazon Web Services, Inc. (AWS): Cloud hosting and file storage through Amazon S3, currently in the United States.
  • MongoDB, Inc. (MongoDB Atlas): Managed database service. Processing location depends on cluster region and may include the United States.

Additional payment, analytics, and communications providers may be used. Request the current list from [email protected].

Cross-border transfers (EEA / UK)

For personal data transferred outside the EU/EEA/UK, we rely on the European Commission's Standard Contractual Clauses (SCC 2021) and equivalent UK-approved transfer mechanisms, with supplementary technical and organizational measures including encryption and access controls. See the privacy policy for the full terms.

Architecture Selection

Cloud vs Self-Hosted Enterprise comparison

In the cloud, A-Packets operates the infrastructure and retention policy. With A-Packets Enterprise, your team controls residency, retention, identity, and operations. Available Enterprise controls depend on the licensed scope, including Kubernetes, SSO, SCIM, audit logs, and air-gapped delivery.

Cloud (apackets.com)

Where captures reside
AWS S3, currently in the US; MongoDB Atlas, with region depending on cluster.
Data leaves your network
Yes. Captures are uploaded to A-Packets for analysis.
Outbound access
Required to use the hosted service.
Retention control
A-Packets policy: anonymous uploads deleted at least every 24 hours, Pack reports after 30 days; subscriptions provide permanent private storage.
Result visibility
Public analysis has a public result page; private analyses stay out of the public feed.
Identity and authentication
Local accounts, passkey/WebAuthn, OAuth through Google, Microsoft, and GitHub.
Audit log
For customer audit requirements, contact us.
Release integrity
A-Packets updates the hosted service.
Sub-processors
AWS and MongoDB; SCC 2021 and UK-approved mechanisms for applicable transfers. Additional providers available on request.
Monitoring and operations
Operated and monitored by A-Packets.
Customer responsibility
Capture contents and the legal basis for processing.
Updates and patches
A-Packets deploys service updates.

Enterprise (on-premise)

Where captures reside
Your PostgreSQL and S3-compatible storage, bundled with Docker Compose.
Data leaves your network
No. Captures, decoded traffic, artifacts, and reports stay in your deployment. No telemetry or license checks are sent to A-Packets.
Outbound access
None required. Air-gapped delivery uses a signed offline bundle imported into your registry. Outbound connections only for configured OAuth, email, or image pulls.
Retention control
Set by the deployment owner.
Result visibility
Workspace membership controls which captures a user can see.
Identity and authentication
Local accounts with passkey 2FA, OAuth, LDAP/AD, SAML 2.0, and SCIM. Verified against AD on Windows Server 2022/2025, Entra ID, and Okta.
Audit log
Sign-ins, uploads, downloads, sharing, and administrative changes, with configurable retention.
Release integrity
Signed images with a published signing key and SBOM per image. Pre-release scanning blocks high-severity findings with an available fix. Delivery archives are checksummed and signed.
Sub-processors
Analysis runs in your infrastructure; A-Packets does not receive captures. You manage your storage and any providers you select.
Monitoring and operations
Your team operates Prometheus apackets_* metrics, /healthz and /readyz probes, reference Grafana dashboards, and alert rules.
Customer responsibility
Servers, OS, Docker/Kubernetes, network ACLs and TLS, IdP, PostgreSQL and object storage with backups, capture handling, and legal basis.
Updates and patches
Your schedule. Software updates and security patches are included for the license term.

When to choose A-Packets Enterprise:

Choose A-Packets Enterprise when captures cannot leave your network under a contract or regulation, residency must remain in your jurisdiction, SSO and audit retention must follow your policies, or the network is air-gapped.

View A-Packets Enterprise Details
Vulnerability Disclosure

Report a vulnerability

Send vulnerability reports for A-Packets to [email protected]. Include affected endpoints, reproducible steps, and the impact you observed.

Machine-readable reporting contacts are available at /.well-known/security.txt (RFC 9116).

Coordinated disclosure expectations:

  • Do not access, modify, download, or disclose data belonging to other accounts.
  • Do not execute denial-of-service attacks, brute-force floods, or actions that degrade service availability.
  • Please wait for our response before publishing the vulnerability.
  • Include reproducible steps, target endpoints, and proof-of-concept requests in your report.

We respond without undue delay.

Related Documentation & Policies

Privacy Policy Legal rights, retention windows, and data protection bases. Terms of Service Acceptable use rules, subscription terms, and user agreements. Frequently Asked Questions Capture formats, protocol analyzers, and account features. On-Premise Architecture Self-hosted Docker, Helm, and offline deployment guides.