Security & Privacy

Logstyx is built with security and privacy as core principles. Your logs stay encrypted, private, and under your complete control.

Encryption

Data at Rest

All sensitive log data is encrypted before storage using AES-256-GCM.

What gets encrypted:

• Log messages
• Metadata fields
• User credentials
• API keys
• Environment variables, yes, even your SECRET_KEY need to be encrypted

⚠️ Important: Keep these keys in .env.encrypted safe. If you lose them, your encrypted data cannot be recovered.

Data in Transit

External connections: All client-to-server communication uses TLS/HTTPS

Internal services: Communication between microservices can use mTLS in production deployments

Hashed Indexing

Log indices are hashed using SHA-256 before storage.

Benefits:

• Fast lookups without exposing raw values
• Privacy protection for sensitive identifiers
• Consistent query performance

Example:

// You send
{ userId: "john@example.com" }

// Stored as
{ userIdHash: "8f43e3f5d6a7b2c1..." }

Authentication

Logstyx uses different authentication methods depending on the client type.

Server-Side (Node.js, Express)

Uses HMAC-SHA256 signature-based authentication:

timestamp = current_unix_timestamp
signature = HMAC-SHA256(timestamp, ApiSecret)

Headers:
  X-Timestamp: {timestamp}
  X-Signature: {signature}

Security features:

• Request must be within 5-minute time window
• Prevents replay attacks
• No API key sent in plaintext

Client-Side (Browser, React, React Native)

User can whitelist domain or reverse domain name (for React Native App)

API Secrets

API Secrets are:

• Encrypted at rest in the database
• Specific to each project

Self-Hosted Privacy

Complete Data Control

• No third-party access - Your data never leaves your infrastructure
• No telemetry - Logstyx doesn't phone home
• No vendor lock-in - All data stored in standard MongoDB format
• Open source - Full transparency, audit the code yourself

Network Isolation

You can deploy Logstyx in isolated networks:

# Example: Internal network only
services:
  gateway:
    networks:
      - internal
    # No exposed ports to public internet

External Services (Optional)

Logstyx can use external MongoDB, Redis, or RabbitMQ:

# Use your existing secured services
MONGODB_HOST=mongodb://your-secured-mongo:27017
REDIS_URL=redis://your-secured-redis:6379
AMQP_HOST=amqp://your-secured-rabbitmq:5672

All connections support authentication and TLS.

Environment Security

Encrypted Configuration

Sensitive environment variables are encrypted via install.sh script which generates encrypted values automatically.

Key Rotation

To rotate encryption keys, you just run ./install.sh with the .env.encrypted file present and it will ask you for confirmation

Security Best Practices

For Deployment

✅ Do:

• Use strong, random encryption keys (32+ characters)
• Enable TLS/HTTPS for all external access
• Use encrypted environment variables
• Keep keys in secure vault (not in git)
• Regularly update Docker images
• Restrict network access with firewalls

❌ Don't:

• Commit .env files to version control
• Use weak or predictable keys
• Expose internal services to public internet

For SDK Integration

✅ Do:

• Store API keys as environment variables
• Use HTTPS endpoints only
• Sanitize logs before sending (remove passwords, tokens)

❌ Don't:

• Hardcode API keys in source code
• Log sensitive data (passwords, credit cards, tokens)
• Send unencrypted logs over HTTP

Vulnerability Reporting

Found a security issue? Please report it responsibly:

1. Don't open a public GitHub issue
2. Contact maintainers privately via email
3. Provide details and reproduction steps
4. Allow time for patch before disclosure

Compliance Considerations

While Logstyx provides strong security features, compliance depends on your deployment:

GDPR:

• Data stays in your infrastructure (data residency)
• You control data retention and deletion
• Encryption at rest meets technical requirements

HIPAA/SOC2:

• Encryption meets standards
• Audit logging available
• You're responsible for access controls and operational security

Note: Logstyx provides tools, but compliance is your responsibility based on how you deploy and manage it.

Regular Security Maintenance

Update Regularly

# Pull latest images
docker compose pull

# Restart with new versions
docker compose up -d

Monitor Security Advisories

Watch the GitHub repository for security updates:

• GitHub Releases
• Security Advisories

Backup Encryption Keys

Store your keys securely outside the deployment:

• Password manager
• Hardware security module (HSM)
• Key management service (KMS)
• Encrypted backup location

What Logstyx Doesn't Do

No magic security:

• Logstyx encrypts data, but you must secure your infrastructure
• You're responsible for server hardening
• You manage network security
• You control access to encryption keys

No PII filtering:

• Logstyx doesn't automatically detect/remove sensitive data
• You must sanitize logs before sending
• Use SDK features to exclude sensitive fields

No automatic compliance:

• Security features enable compliance
• You must configure and operate securely
• Audit your deployment for your requirements

Security Checklist

Before going to production:

• [ ] Strong encryption keys generated
• [ ] Keys stored in secure vault
• [ ] TLS/HTTPS enabled
• [ ] Firewall rules configured
• [ ] Rate limiting enabled
• [ ] Regular backups scheduled
• [ ] Update process documented
• [ ] Access controls configured
• [ ] Logs sanitized in application code
• [ ] Security advisories monitored