Privacy & outbound connections¶
Vesana runs entirely on your own infrastructure. Monitoring data — devices, checks, measurements, logs, user accounts — stays in your database. The vendor has no access to it.
As the operator you are responsible for the data in your instance (the controller under the GDPR). This page lists every connection Vesana opens to the outside on its own, so you can inform your users and configure your firewall accordingly.
Intended use¶
Vesana is built for monitoring servers, network devices and services. It is not intended to monitor the behaviour or performance of employees.
Keep in mind that server logs can still contain personal data — for example logons in a domain controller's security event log, or sshd/sudo entries on Linux. If you collect such logs or install agents on workstations, check the employment-law rules of your country (e.g. Art. 4 Statuto dei Lavoratori in Italy, works-council co-determination in Germany).
Connections to the vendor¶
| Connection | Destination | What is transmitted | When | Turn off |
|---|---|---|---|---|
| Instance pulse | license.vesana.org |
Instance ID, version, host name of the API container, public server URL, kernel and architecture, time zone and UI language, edition and whether a licence key is entered, installation date and database level, certificate mode (self-signed/ACME/own), number of hosts/checks/agents/collectors (total and online)/tenants/accounts, oldest agent version, time of the last login and number of active accounts in the last 7 days. No device or tenant names, no measurements, no user names. | once a day | VESANA_PULSE=off in .env |
| Update check | license.vesana.org |
Instance ID, licence key, installed version | when the update page is opened and regularly while auto-update or automatic security updates are on | turn both off; the check then only runs on demand |
| Licence pick-up | license.vesana.org |
Instance ID | hourly, while no own licence key is entered | enter your own licence key |
| Update download | ghcr.io (GitHub Container Registry), license.vesana.org |
regular download request (IP address) | on every update | — (updates only) |
| Feedback | license.vesana.org, from there as an entry in the vendor's issue tracker (GitHub) |
your text, category, attached screenshots, name and user name of the sender, server URL, version | only when someone uses the feedback button | don't use the button |
| Support bundle | license.vesana.org |
diagnostic data of your instance (device and check list, settings, logs, versions). Passwords, keys and tokens are removed before sending; a bundle in which a secret is detected is discarded. Sections can be deselected before sending. | only when an admin explicitly sends it | don't send it (download instead) |
| Vesana library | community.vesana.org (or the configured address) |
requests while browsing and installing profiles, icons and MIBs and when checking for new profile versions, including the license's update channel (tester or all); before the SNMP walk of a device whose vendor MIBs are missing, the device's sysObjectID (vendor/model identifier, no address, no name) | when using the library, hourly for automatic profile updates, and on SNMP walks | don't use the library and turn off Update profiles automatically; the lookup before a walk cannot be turned off |
Connections to third parties¶
| Connection | Destination | What is transmitted | When |
|---|---|---|---|
| Certificate (ACME) | the chosen CA (e.g. Let's Encrypt) and, with DNS validation, your DNS provider's API | certificate names, public account key, validation record | only when a certificate is issued or renewed under Admin → System → Certificate |
| World map | tiles.openfreemap.org or tile.openstreetmap.org |
the user's browser loads map tiles; the provider sees the IP address and the map area | when the world map is opened |
| Internet line check | Measurement Lab (locate.measurementlab.net and its test servers) |
speed test from the collector machine. Measurement Lab publishes test results including the public IP address as open data. | only if an internet line check exists |
| AI features | the provider you configured (e.g. Anthropic, OpenAI or an OpenAI-compatible service) | questions in the AI chat, check data in the AI analysis | only if a cloud provider is configured. With local Ollama, questions and answers stay on the server (except for the web search, see next row). |
| AI web search | DuckDuckGo | AI chat: the question. AI analysis: check name, check type and the current message of the check | when the wiki returns too little — also with local Ollama. In the AI chat it can be turned off via the "Web" source; the AI analysis always searches in that case. |
| Notifications | the services behind your channels (mail server, Telegram, Slack, Teams, Discord, ntfy, Pushover, PagerDuty, Opsgenie, webhooks …) | the alert content: device and check name, status, message text | on every alert |
| Phone push | push service of the browser vendor (Google, Mozilla, Apple) | encrypted alert content | when push notifications are enabled |
Agents and collectors only ever talk to your Vesana server.
Cookies and local storage¶
Vesana sets only strictly necessary cookies. No consent (cookie banner) is required for them.
| Cookie | Purpose | Lifetime |
|---|---|---|
vesana_access |
sign-in (short-lived access key, valid 30 minutes and renewed silently) | as the session |
vesana_refresh |
stay signed in | until the session ends (default: at most 90 days) |
vesana_csrf |
protection against forged requests | same as the session |
vesana_sso_bind |
protection when signing in through an external identity provider (SSO) | a few minutes |
Vesana keeps UI settings such as language, colour theme, sidebar and dismissed hints in the browser's local storage. These values never leave the browser.
Vesana uses no analytics, tracking or advertising cookies.