Data handling
Last updated 28 October 2026.
This page describes, in detail, how the Posterna service handles data. The privacy policy is the short version. Questions: [email protected].
Posterna has two parts. The open-source packages run inside your own app. The hosted service at posterna.com receives counts from them, shows your dashboard, and runs the public probe, echo endpoint and agent lab. Your visitors' requests never reach the hosted service.
What the packages send
Nothing, unless you give them a site key. With a site key, each install sends one report to https://posterna.com/v1/ingest at most once a minute:
- Counts per hour, broken down by verdict, reason code, operator, agent, purpose, path group, the action your policy took, and whether it was enforced, with the bytes served.
- Path groups, not paths. The first parts of a path, with anything that looks like an identifier replaced by
:id, at most 50 groups per report. For example/orders/:id/*. - Install state: a random instance id made fresh each time the app starts (the WordPress plugin keeps one random id per site, because each WordPress request is a separate process), the package name and version, the runtime, the mode (monitor or enforce), the directory and keys versions in use, a hash of your policy, an error count, whether the proxy guard has suspended enforcement, how many actions the search-engine guard downgraded, and which safety breakers have tripped.
The packages never send IP addresses, full URLs, query strings, header values, or request or response bodies. Verification happens in your app; no request is forwarded anywhere. The report travels over HTTPS with your site key in a header. The service compares a hash of the key and never logs it.
The packages also download the signed operator directory and keys from posterna.com (/v1/directory.json, /v1/keys.json and their signatures). Those downloads carry no data about your site or your visitors.
What the service stores
| Data | Why | What it contains | Kept |
|---|---|---|---|
| Your account | Sign-in | From GitHub: your account id, username, name, email address and avatar. No GitHub access token. | Until you delete your account |
| Sessions | Keep you signed in | A random session token and its expiry | Until it expires, 30 days after your last visit, then deleted within a day; at once when you sign out or delete your account |
| Sites | Your dashboard | Name, domain, a SHA-256 hash of the site key and its first 12 characters for display. The full key is shown once and not stored. Whether the remote switch holds installs in monitor mode, and when the site last reported. | Until you delete the site or your account |
| Install records | Your dashboard | The install state above, per instance, and when it last reported | 30 days after the install last reported; at once when you delete the site or your account |
| Hourly counts | Your dashboard | The counts above, per hour | 13 months; at once when you delete the site or your account |
| Probe runs | The probe report | The domain, a salted hash of the requester's IP address (only to limit runs to 10 an hour), and the results: status codes, sizes, SHA-256 fingerprints, redirect counts and the host and path a redirect ended on, the names of firewall and CAPTCHA markers, and the paths probed. Never page contents. Anyone with a report's link can open it. | 30 days, after which the report link stops working |
| Operator requests | Reviewing listing requests | What the form asks for: organization, contact email, key directory URL, agent names and notes | 12 months |
| Directory releases | Serving the signed directory and keys | Public data about AI operators, signed by Posterna | 90 days, except the latest of each kind |
| Lab runs | Posterna's own tests of how AI agents identify themselves | Only for lab links Posterna makes for its tests, which carry a signed run id: the time, the verdict and reason, the operator and agent, the User-Agent, the signature details (key id, algorithm, times, nonce length, covered fields, Signature-Agent), the IP version, and whether Accept-Language was sent. Never the IP address. | 90 days |
A job runs once a day and deletes each kind of data when its period in the last column has passed.
The echo endpoint (/v1/echo) and the agent lab (/lab) store and log nothing about the requests they check, except the lab runs above, from links Posterna makes for its own tests. They use the client's IP address for the check and for rate limiting in memory, and never show or keep it.
posterna.com runs Posterna on itself, in monitor mode, as one more site: its own visits become the same hourly counts any install sends, kept like any site's counts. The install API (/v1/), the agent lab and the health check are left out.
Posterna's own application logs record errors only, never IP addresses, URLs, header values or request bodies. Posterna's administrators can see the number of sites and users, operator requests, the most recent install records (domain, package and version, mode), and each site's domain with its owner's GitHub username, so they can mark the sites Posterna runs itself. Only those sites' counts feed Posterna's internal verification checks; your counts are never analyzed for them.
Where it lives
- Railway runs the web service, the scheduled jobs and the Postgres database, all in its US West region (California, USA). Secrets, including Posterna's signing keys, are kept only in Railway's environment variables.
- Cloudflare provides DNS for posterna.com and carries every request to it, including the reports from installs.
- GitHub handles sign-in.
- Mailgun receives email sent to posterna.com addresses.
Railway and Cloudflare see the IP address and details of every request to posterna.com, including the address of the server an install reports from, and may keep logs of them under their own policies.
Deleting data
- A site: in the site's Settings, type its domain to confirm. Its key, install records and counts are deleted at once. Installs still using the key keep running in your app, and posterna.com refuses their reports.
- Your account: on the Account page, type your GitHub username to confirm. Your account, GitHub link, sessions, sites, keys, install records and counts are deleted at once, and you are signed out. GitHub keeps listing Posterna among your authorized apps until you revoke it at github.com/settings/applications.
- A probe report, an operator request, or anything else: email [email protected].