Privacy Architecture
Tamandua follows a simple rule:
Private detection. Public proof.Endpoint telemetry is processed by the self-hosted server. Public attestations contain only cryptographic hashes and minimal, sanitized metadata.
Privacy Pipeline
- The agent sends endpoint telemetry to the operator-controlled server.
- The detection engine creates an alert and extracts candidate IOCs.
- The attestation module redacts sensitive fields.
- The server builds a manifest with hashes, severity, MITRE IDs, IOC counts, and safe labels.
- Only the privacy-safe manifest hash and allowed metadata are published.
Redaction Rules
Fields such as hostnames, usernames, internal IP addresses, local paths, command lines, process trees, credentials, and raw payloads are excluded from public attestations.
When an IOC could identify a victim or internal environment, Tamandua should publish only a hash or type count instead of the raw value.
Attestation Modes
| Mode | Behavior |
|---|---|
| Local only | Store attestations locally without publishing to Solana |
| Relay | Use the Tamandua relay to publish privacy-safe proofs |
| Self pay | Publish directly from the operator's own Solana wallet |
Why This Matters
Security teams often need tamper-evident proof metadata without leaking incident details. This model lets auditors, insurers, protocol partners, and Web3 operators verify that an attestation was generated while keeping the sensitive investigation data private.