Data security

Alpacon implements comprehensive data security measures to protect your sensitive information throughout its lifecycle.

Encryption

Data in transit

All data transmitted between components is encrypted using industry-standard protocols:

TLS 1.2+: Minimum TLS version for all HTTPS connections
WebSocket Secure (WSS): Encrypted WebSocket connections for real-time features
Websh protocol: Proprietary protocol built on HTTPS/WSS that routes terminal sessions through Alpacon Gateway for audit logging and compliance
Perfect forward secrecy: Ensures past communications remain secure even if keys are compromised

Connection flow:

Browser → [TLS 1.2+] → Alpacon Gateway (audit/logging) → [TLS 1.2+] → Alpamon Agent → [Local] → Server

Why gateway-based architecture?

Unlike traditional end-to-end encrypted connections, Alpacon’s gateway-based approach provides critical security and compliance benefits:

Complete audit trail: Every command and action is logged for forensic analysis and compliance
Real-time monitoring: Security teams can monitor sessions in real-time for suspicious activity
Session recording: Session records can be retrieved for training, troubleshooting, and compliance audits
Policy enforcement: Gateway can enforce security policies (block commands, require approvals, etc.)
Compliance ready: Meets requirements for SOC 2, HIPAA, PCI-DSS that mandate audit logging

While data transits through the gateway, it remains encrypted in transit using TLS 1.2+, protecting against network-level attacks.

Data at rest

Sensitive data stored in Alpacon’s infrastructure is encrypted:

AES-256 encryption: Industry-standard encryption for stored data
Encrypted databases: All database storage is encrypted at rest
Credential storage: Authentication credentials are securely hashed and encrypted
Session data: Terminal session recordings are encrypted at rest

Key management

Separation of duties: Key management and data access are separated
Key storage: Keys are managed through a Secrets Manager
Leak prevention: Keys are encrypted using Sealed Secret technology
Access control: Key access is managed with IAM permissions

Data storage & retention

Data categories

Alpacon stores the following types of data:

1. Account information

User profiles (name, email, avatar)
Authentication credentials (hashed passwords, MFA secrets)
Organization/workspace metadata

Retention: Duration of account lifetime + 30 days after deletion

2. Infrastructure data

Server metadata (names, IPs, platforms, groups)
Server status and performance metrics
System logs

Retention: Duration of workspace lifetime + 90 days after deletion

3. Audit logs

User authentication events
Websh history
WebFTP history
Command history
User activity

Retention by plan:

Free plan: Audit logs not available
Essentials plan: 1 year
Enterprise plan: 5 years

4. Session data

Terminal session metadata (duration, user, server, timestamps)
Terminal session recordings (always recorded for security and compliance)

Retention by plan:

Free plan: Session history not available
Essentials plan: 1 year
Enterprise plan: 5 years

5. Support data (Coming Soon)

Support tickets: Issue reports
Communications: Correspondence with users
Diagnostic logs: Screenshots, detailed descriptions

Retention: 2 years from ticket closure

Data residency & sovereignty

Regional data storage

When creating a workspace, you select your data region:

Region	Location	Data Storage	Processing	Status
AP1	Asia-Pacific (Seoul)	AWS Seoul Region	APAC	Active
US1	United States (East)	AWS US-East-1	US	Coming Soon

Backup infrastructure (in progress)

Dedicated backup infrastructure is established with cloud-independence for disaster recovery
All data is automatically backed up to dedicated backup infrastructure for disaster recovery
Encrypted backups with geographic redundancy
Regular backup testing and validation

Key points

Data is primarily stored in your selected region
Automatic backups to secondary location for disaster recovery
No cross-region data replication except for backups
Processing occurs within the same region as data storage
Complies with regional data sovereignty requirements

Data isolation

Workspace isolation: Each workspace has isolated data storage
Database separation: Logical database separation per workspace
Network isolation: Network-level isolation between workspaces
Access controls: Strict access boundaries enforced

Backup & disaster recovery (in progress)

Backup strategy

Automated backups: Daily automated backups of all data
Encrypted backups: All backups are encrypted using AES-256
Multi-region backup: Supports geographic redundancy
Point-in-time recovery: Restore to any point within retention period

Recovery objectives

RTO (Recovery Time Objective): < 4 hours for full service restoration
RPO (Recovery Point Objective): < 1 hour of data loss in disaster scenarios
Backup Retention: 30 days for standard backups, 90 days for Enterprise

Disaster recovery testing

Quarterly disaster recovery drills
Annual full-scale recovery tests
Documented recovery procedures

Data deletion

Account deletion

When you delete your account:

Immediate: Account access is revoked immediately
Audit logs: Anonymized and retained per retention policy for compliance

Workspace deletion

When you delete a workspace:

Immediate: Workspace access is revoked immediately
Audit trail: Retained in anonymized form per compliance requirements

Right to deletion

Users can request data deletion at any time:

Email: privacy@alpacax.com
Expected response time: 48 hours
Deletion completed within 30 days

Data privacy compliance

For EU/EEK customers, Alpacon provides:

Data Processing Agreement (DPA): Available upon request
Right to access: Request copy of your data
Right to rectification: Correct inaccurate data
Right to erasure: Request data deletion (“right to be forgotten”)
Right to portability: Export data in standard formats
Privacy by design: Privacy considerations in all feature development

CCPA (California Consumer Privacy Act)

For California residents:

Disclosure: Clear disclosure of data collection practices
Opt-out: Right to opt-out of data “sale” (we don’t sell data)
Access & deletion: Same rights as GDPR users
Non-discrimination: No penalties for exercising privacy rights

Data export

🚧 Coming soon - Data export functionality is currently in development

We are building comprehensive data export features to ensure full data portability and compliance with privacy regulations (GDPR Article 20 - Right to Data Portability).

Planned export capabilities

Workspace configuration: Export all workspace settings and configurations
Audit logs: Export complete audit trail in CSV or JSON format
Server metadata: Export server list and configurations
User data: Export user accounts and permission settings
Session recordings: Export terminal session recordings (subject to retention policy)

Planned export formats

JSON: Structured data (servers, users, groups, configurations)
CSV: Tabular data (audit logs, user lists, activity logs)
Video Format: Session recordings

Access methods (when available)

CLI commands for automated exports
Web interface for manual exports
API endpoints for programmatic access
Scheduled exports (automatic periodic exports)

Timeline: Data export functionality is actively being developed. Contact support@alpacax.com if you need specific data export capabilities for compliance or migration purposes.

Third-party access

No automatic sharing: We never share your data with third parties
Your control: Only you decide who accesses your workspace
Service providers: Only minimal, trusted providers (such as AWS and dedicated backup infrastructure providers) under strict contractual agreements

Monitoring & incident response

Security monitoring

24/7 monitoring: Continuous monitoring of security events
Anomaly detection: Automated detection of unusual access patterns
Real-time alerts: Immediate notification of security incidents
SIEM integration: Security information and event management (coming soon)

Incident response

In case of a data security incident:

Detection & triage: < 1 hour
Containment: < 4 hours
Investigation: < 24 hours
Customer notification: < 72 hours (as required by GDPR)
Remediation: Varies by severity
Post-incident review: Within 2 weeks

Best practices for customers

To maximize data security:

Passwordless authentication: Secure login without the risk of ID/password leaks
Enable MFA: Require multi-factor authentication for all users
Minimize data exposure: Restrict access using IAM groups
Data retention configuration: Configure data retention periods according to your subscription plan
Session recording review: Regularly review terminal session recordings
Monitor audit logs: Regularly review access and activity logs

Security overview - Overall security approach
Authentication & access control - Authentication methods
Network security - Network architecture and security
IAM management - User access management

Contact

For data security inquiries:

Email: security@alpacax.com
Privacy: privacy@alpacax.com
Data deletion requests: privacy@alpacax.com

Last updated: November 2025