Data security

Alpacon implements comprehensive data security measures to protect your sensitive information throughout its lifecycle.

Encryption#

Data in transit#

All data transmitted between components is encrypted using industry-standard protocols:

• TLS 1.2+: Minimum TLS version for all HTTPS connections
• WebSocket Secure (WSS): Encrypted WebSocket connections for real-time features
• Websh protocol: Proprietary protocol built on HTTPS/WSS that routes terminal sessions through Alpacon Gateway for audit logging and compliance
• Perfect forward secrecy: Ensures past communications remain secure even if keys are compromised

For transport configuration (TLS versions, cipher suites, and certificate management), see Platform security and availability.

Connection flow:

Browser → [TLS 1.2+] → Alpacon Gateway (audit/logging) → [TLS 1.2+] → Alpamon Agent → [Local] → Server

Why gateway-based architecture?

Alpacon protects connections with TLS. The gateway reads session content so it can mask credentials in records and apply security checks:

• Complete audit trail: Every command and action is logged for forensic analysis and compliance
• Real-time monitoring: Security teams can monitor sessions in real-time for suspicious activity
• Session recording: Session records can be retrieved for training, troubleshooting, and compliance audits
• Policy enforcement: Gateway can enforce security policies (block commands, require approvals, etc.)
• Compliance ready: Meets requirements for SOC 2, HIPAA, PCI-DSS that mandate audit logging

While data transits through the gateway, it remains encrypted in transit using TLS 1.2+, protecting against network-level attacks.

Data at rest#

Sensitive data stored in Alpacon’s infrastructure is encrypted:

• AES-256 encryption: Industry-standard encryption for stored data
• Encrypted databases: All database storage is encrypted at rest
• Credential storage: Authentication credentials are securely hashed and encrypted
• Session data: Terminal session recordings are encrypted at rest

Key management#

• Key storage: Keys are stored in a dedicated secrets management system
• Leak prevention: Keys are encrypted using Sealed Secret technology
• Access control: Key access is managed with IAM permissions

Data storage & retention#

Data categories#

Alpacon stores the following types of data:

1. Account information#

• User profiles (name, email, avatar)
• Authentication credentials (hashed passwords, MFA secrets)
• Organization/workspace metadata

After account deletion: The account profile is anonymized immediately. Activity records keep the username and IP as recorded, for as long as the workspace keeps its activity records, to preserve the audit trail.

2. Infrastructure data#

• Server metadata (names, IPs, platforms, groups)
• Server status and performance metrics
• System logs

After workspace deletion: Workspace database rows are removed immediately. Activity records, session recordings, and logs are normally removed within minutes. Backups expire within 3 days. Integrity hashes, which contain no personal data, are kept.

Raw monitoring metrics are deleted after 7 days on every plan. Monitoring rollups are deleted after 31 days on Essentials and 365 days on Enterprise; Free has no rollups. System logs are deleted after 7 days on Free, 31 days on Essentials, and 365 days on Enterprise.

3. Audit logs#

• User authentication events
• Websh history
• WebFTP history
• Command history
• User activity

What you can view by plan:

• Free plan: Your own session and command records from the last 7 days; the activity log is not available
• Essentials plan: Workspace records from the last 120 days
• Enterprise plan: Workspace records from the last 365 days, extendable by contract

These are viewing windows, not deletion dates.

4. Session data#

• Terminal session metadata (duration, user, server, timestamps)
• Terminal session recordings (recorded on paid plans; tunnel and code-editor sessions are not recorded)

What you can view by plan:

• Free plan: Your own session history from the last 7 days; recordings are not available
• Essentials plan: Session history and recordings from the last 120 days
• Enterprise plan: Session history and recordings from the last 365 days, extendable by contract

These are viewing windows, not deletion dates.

Alpacon AI improvement#

Alpacon keeps de-identified records from session activity to measure the accuracy of threat detection and execution judgment and improve detection, as described in section 10.2 of the Privacy Policy. The workspace owner controls whether the workspace contributes, with one switch in workspace settings on every plan. It’s on by default, except for workspaces that were on the Enterprise plan when they became active. Those are included only if the owner turns it on. Turning it off stops further collection, though a session already sent for analysis may still be collected for up to about an hour. Records already collected are not associated with a workspace and are deleted 24 months after collection. See Alpacon AI for where to change it.

Data residency & sovereignty#

Regional data storage and processing#

When creating a workspace, you select your data region:

The selected region determines where workspace data and core service records are primarily stored. For AP1, uploaded files and temporary file transfers (WebFTP) are kept in AWS S3 in the Seoul Region, and encrypted backups are stored there too. When Alpacon AI features are used, session and command data required to provide those features is transferred to and processed on AlpacaX-operated infrastructure in South Korea. Data remains encrypted in transit.

Key points

• Workspace data and core service records are primarily stored in your selected region
• The standard SaaS service does not guarantee that all processing occurs in the selected storage region
• Alpacon AI processing in South Korea may involve a cross-border data transfer, depending on the selected region

Enterprise deployment options#

Alpacon Enterprise supports deployment in customer-controlled cloud or on-premises infrastructure for organizations with specific data residency, processing-location, network-isolation, or regulatory requirements. Deployment scope and architecture are agreed based on each organization’s requirements. Contact sales@alpacax.com to discuss an Enterprise deployment.

Data isolation#

• Workspace isolation: Each workspace has isolated data storage
• Database separation: Logical database separation per workspace
• Network isolation: Network-level isolation between workspaces
• Access controls: Strict access boundaries enforced

Backup & disaster recovery#

Backup strategy#

• Automated backups: Automated database backups
• Encrypted backups: All backups are encrypted using AES-256
• Point-in-time recovery: Restore to any point within retention period

Recovery objectives#

• RTO (Recovery Time Objective): < 4 hours for full service restoration
• RPO (Recovery Point Objective): < 1 hour of data loss in disaster scenarios
• Backup Retention: 3 days of automated backups, which is also the point-in-time recovery window

Disaster recovery testing#

• Semi-annual disaster recovery drills
• Documented recovery procedures

Data deletion#

Account deletion#

When you delete your account, access is revoked and your account profile is anonymized immediately. Activity records retain your username and IP as recorded, for as long as the workspace keeps its activity records, because the audit trail must remain intact.

Workspace deletion#

Only a Superuser can delete a workspace. Deletion has no grace period and cannot be undone. Workspace database rows are removed immediately. Activity records, session recordings, and logs are removed shortly afterward, normally within minutes. Backups expire within 3 days. Integrity hashes, which contain no personal data, are kept.

Right to deletion#

Users can request data deletion at any time:

• Email: privacy@alpacax.com
• Expected response time: 48 hours
• Deletion completed within 30 days

Data privacy compliance#

GDPR (General Data Protection Regulation)#

For EU/EEK customers, Alpacon provides:

• Data Processing Agreement (DPA): Available upon request
• Right to access: Request copy of your data
• Right to rectification: Correct inaccurate data
• Right to erasure: Request data deletion (“right to be forgotten”)
• Right to portability: Export data in standard formats
• Privacy by design: Privacy considerations in all feature development

CCPA (California Consumer Privacy Act)#

For California residents:

• Disclosure: Clear disclosure of data collection practices
• Opt-out: Right to opt-out of data “sale” (we don’t sell data)
• Access & deletion: Same rights as GDPR users
• Non-discrimination: No penalties for exercising privacy rights

Data export#

Request a workspace data export from support@alpacax.com.

On paid plans, use Export evidence to download external access records as a ZIP containing logins.csv, coverage.csv, and summary.txt. You can also read records through the API (or alpacon api).

Third-party access#

• No automatic sharing: We never share your data with third parties
• Your control: Only you decide who accesses your workspace
• Service providers: Only minimal, trusted providers (such as AWS and Auth0 by Okta) under strict contractual agreements

Monitoring & incident response#

Security monitoring#

• 24/7 monitoring: Continuous monitoring of security events
• Anomaly detection: Automated detection of unusual access patterns
• Real-time alerts: Immediate notification of security incidents

Incident response#

In case of a data security incident:

1. Detection & triage: < 1 hour
2. Containment: < 4 hours
3. Investigation: < 24 hours
4. Customer notification: < 72 hours (as required by GDPR)
5. Remediation: Varies by severity
6. Post-incident review: Within 2 weeks

Best practices for customers#

To maximize data security:

1. Passwordless authentication: Secure login without the risk of ID/password leaks
2. Enable MFA: Require multi-factor authentication for all users
3. Minimize data exposure: Restrict access using IAM groups
4. Review activity records: Review records within your plan’s viewing window
5. Session recording review: Regularly review terminal session recordings
6. Monitor audit logs: Regularly review access and activity logs

Related documentation#

• Security overview - Overall security approach
• Authentication & access control - Authentication methods
• Platform security and availability - Transport encryption and platform protections
• Network security - Network architecture and security
• IAM management - User access management

Contact#

For data security inquiries:

• Email: security@alpacax.com
• Privacy: privacy@alpacax.com
• Data deletion requests: privacy@alpacax.com

Last updated: September 2026