Privacy

About this page

Effective 25 September 2026. Updated 16 October 2026. This page covers the Minaki suite — the Minaki Scan software and the suite agent — and visits to minaki.io. All are operated by MinakiLabs LLC. The TunnelNet service has its own policy at tunnelnet.io/privacy.

We want to know how many people read this site and which pages are useful. We do not want to follow anyone around the internet. This page says exactly what we collect when you visit, how long we keep it, and what we do not do.

What Minaki Scan reads, changes and sends

Minaki Scan makes no network connections. It sends nothing to us or to anyone else. Your results, your server's name, its files and its settings stay on your server.

What it reads: SSH settings; the login key files in root's and every user's home folder; /etc/passwd, /etc/group and /etc/shadow, to find accounts with no password, extra root accounts and accounts that can control Docker; sudo rules; /etc/ld.so.preload; scheduled tasks, services, login scripts and /etc/environment; the folders in root's command path; the running programs and the files they run from; which network ports are listening; the files in /tmp, /var/tmp and /dev/shm, and at the places its malware list names; the SSH login log; when the server was first set up; whether updates install automatically or are waiting for a restart; the firewall rules and which firewall parts the kernel has loaded; the kernel's network and crash-dump settings; whether the clock is kept right; which Linux this is (/etc/os-release); whether it is a Proxmox server (/var/lib/dpkg/status and /etc/pve) and the names of the other servers in its cluster (/etc/pve/corosync.conf), so the firewall advice fits; and which files in /etc, /usr, /boot, /opt, /srv, /bin, /sbin, /lib, /lib32 and /lib64 any user can change.

What it runs: sshd, to read and test SSH settings; journalctl, to read the SSH log when it cannot read a log file; nft, iptables and ip6tables, to read the firewall rules; ss, to list the ports the firewall advice must keep open; and timedatectl, to see whether the clock is kept right. During a fix you approve it also runs systemctl, to reload SSH or to stop a malware service.

What a scan changes: nothing. A scan only reads, and prints its report on your screen.

What a fix changes: nothing until you type yes. An SSH fix writes /etc/ssh/sshd_config.d/00-minaki-scan.conf. A malware removal stops the malware's programs and services, and deletes its files and its lines in scheduled tasks and login key files. Before a fix edits or deletes a file, it keeps a copy in /var/lib/minaki-scan/, and it records each fix in /var/lib/minaki-scan/changes.log. These stay on your server.

Updates: Minaki Scan never downloads anything, not even its own updates. Updates come through your package manager, or through our separate minaki-update program, which goes online only when you run it. It downloads the signed release list and the new release from dl.minaki.io. Like any download, that server sees your server's internet address, the files asked for and the name of the download tool, and nothing else about your server.

License: this version does not check a license. When the check is added, it will run on your server without contacting us.

Shared defense (off until you turn it on)

Shared defense is a separate, opt-in feature: a server can opt in to share the signals of an attack it sees, so every customer's protection stays current. It is off by default, and we explain it in full before you can turn it on.

If you opt in, your server sends only attack signals: the attacker's network address, the pattern of the attack, and a fingerprint (a hash) of any malware file. It never sends your files or their contents, your data, your passwords, keys or credentials, or anything that identifies you or your business. We do not sell customer data to anyone. See shared defense for the detail.

The suite agent — what it sends

The malware & server check runs on your server and sends nothing. The rest of the suite runs through a small agent on your server that sends us findings for analysis. Below is the exact, word-for-word disclosure of everything it sends; this page and How it works always say the same thing.

What the MinakiLabs agent sends from your server

The malware check on its own keeps everything on your server. The other checks need a small program, the MinakiLabs agent, running on your server. It sends us short summaries so the heavy work happens on our side, not on your server. This is everything it sends:

• Your server's name, once, when you add the server.
• Logins. Failed login attempts, grouped by address and minute: the address, how many tries, and up to three of the account names tried. Successful logins: the account, the address it came from, and whether it used a password or a key. Of a successful login we keep only the address, the time and password-or-key (never the account name), so your report can tell the addresses your team logs in from apart from attackers', and never tells you to block your own.
• Accounts. A new account's name, number and login shell. An account given admin rights, and which admin group. A new login key: its fingerprint and the account. Never the key itself, never passwords or password hashes.
• Programs and files. For new or changed programs in temporary folders and in the folder for programs installed by hand: where the file is, its size, owner, the time it changed and its fingerprint. For system programs that no longer match the copy your system installed: where it is, which package it came from, and its fingerprint. Never what is inside a file.
• Things that start on their own. Where a new or changed service, scheduled task or preload file is, and its fingerprint. Never what is inside it.
• Unusual running programs. Only programs running from a temporary folder or from a deleted file: the program's name, where it runs from, its fingerprint and the account running it. Never its command line, its settings or its memory.
• Open ports. When it changes: the port number and the name of the program that opened it.
• Network counts. Every 5 minutes: how many connections and how many different sources reached each open port, and how many places your server connected out to. An address is sent only when it is on MinakiLabs' list of known attackers, or when it is reaching many of your server's ports. Never what was sent over a connection, never web addresses or site names, never the addresses your server normally talks to.
• Your server's own addresses. The addresses on its network cards, when they change, and the public address its reports arrive from. They let us recognise a login or connection from another of your own servers as yours, so it is never reported as an attacker or shared as one.
• Installed software. The name and version of each installed package, only when the list changes. For programs built with Go, which carry their own list of built-in parts: where the program is, its Go version, and the name and version of each built-in part.
• Malware and server check. If Minaki Scan is installed, once a day its results: what it found, why it matters, the fix, and the short evidence it points to (a setting and its value, a program's name and where it runs from, a file's location, an address and how many times it tried to log in). Scan never changes anything on its own: every fix waits for you to say yes on the server.
• The agent's own use of memory and processor time, so we can keep it small.

Auto-block (off unless you turn it on). If you run sudo minaki-autoblock enable, the agent package also blocks MinakiLabs' list of known attackers in your server's own firewall, and refreshes the list every 6 hours. It only downloads that list; it sends nothing about your server. It never blocks you while you are logged in, your server's own addresses, your organization's other servers and the addresses you marked as trusted, addresses you let through (sudo minaki-autoblock allow ADDRESS), or the big networks that deliver websites and search engines. It only stops new connections from a listed address, so your server can still reach it. If the list is more than 14 days old, it removes every block rather than keep an old list. sudo minaki-autoblock why ADDRESS says whether an address is blocked and why, and sudo minaki-autoblock disable (or removing the agent) takes every block away.

How it travels: encrypted, over HTTPS, to MinakiLabs only, signed in with your server's own login.

How long we keep it: 30 days, then it is deleted, together with the reports made from it. The list of installed software is deleted as soon as it has been checked; the result is kept for 30 days.

Never sold. Attacker addresses are added to the shared list only if you turn sharing on. It is off unless you turn it on.

Downloads and buying

Downloads and sales are not open yet. Downloading Minaki Scan or its updates will be an ordinary request to our download server, and buying it will involve billing details. We will add how we handle both to this page before either opens.

What we collect when you visit minaki.io

Page-view statistics

A small script from our own analytics server (Umami, which we run ourselves, not a third-party service) records:

• the page you viewed, and the page that linked you to it (the referrer), without any query string
• your country and approximate region and city, worked out from your IP address at the moment of the visit
• your browser, operating system, device type, screen size and language

The script sets no cookies and stores nothing on your device. It does not store your IP address. To count unique visitors it uses a one-way hash that cannot be turned back into your address and that changes over time. If your browser sends Do Not Track, the script records nothing.

Server logs

Like almost every website, our web server logs each request: your IP address, the time, the page requested, the referrer and your browser's user-agent string. We use these logs to keep the site running and secure. We also look up which network an address belongs to (its internet provider or organisation, and the network's city) using an offline database, so we can see what kinds of organisations read our pages.

The terminal on the network page

What you type into the terminal on our network page is answered and then discarded. It is not logged or stored. Only the fact that a connection was opened appears in the server log above.

How long we keep it

Anything that contains your IP address is deleted within 30 days. That covers our web-server logs, our visitor records, and the logs and records of our sign-in service (auth.minaki.io). Our backups do not contain IP addresses from visitor records.

Two records outlive that, because they contain no IP address at all, not even a shortened or masked one:

• Traffic history, kept indefinitely. For each page request made by a web browser: the time, the site and page, the response status, the page that linked to it (with any long identifiers in that link removed), any campaign tag in the link (such as utm_source), a coarse device and browser type (for example "mobile/safari"), and the network the request came from: its network number (ASN), the organisation or internet provider that owns it, and the city and country the network is located in. With no IP address it is traffic history, not visitor data. Requests from automated clients (bots, scanners, our own uptime monitors) are left out entirely.
• Sign-in history, kept 90 days, if you have an account and sign in through auth.minaki.io. For each sign-in attempt to your account: the account, the time, whether it succeeded or failed, and the network it came from (ASN, network owner, country). No IP address. We keep it to investigate compromised accounts and to answer disputes.

Page-view statistics contain no IP address and are kept while they remain useful as aggregate history.

What we do not do

• No advertising trackers, no third-party analytics, no social-media pixels.
• No cross-site tracking: we do not follow you onto other websites, and nothing we collect can be linked to you on another site.
• No fingerprinting, and no cookies. This site sets no cookies at all. If you pick a light or dark theme, your browser remembers that choice on your own device; it is never sent to us.
• We do not sell this data, and we do not share it with anyone for advertising or any similar purpose.
• We do not try to identify you personally. Network lookups identify the owner of a network (a company, university or internet provider), not the person using it. A few networks are registered to an individual; for those, the owner's name is a person's name.

Third parties your browser contacts

This site serves its own fonts, so loading a page does not contact a font service. The terminal on our network page loads its terminal component from jsDelivr (cdn.jsdelivr.net), so your browser contacts jsDelivr when you open that page. That request goes directly from your browser to them, under their own policy. We do not send them anything about you.

Who can see it

Only the operator of MinakiLabs. The analytics server and its database run on our own hardware. Network lookups use DB-IP's database (db-ip.com) offline, so no visitor data is sent to them.

Your choices

• Turn on Do Not Track in your browser and the analytics script records nothing.
• Blocking the script, or browsing with JavaScript off, makes no difference to how the site works.
• To ask what we hold about your IP address, or to have it deleted before 30 days, email support@minakilabs.com with the address and roughly when you visited.

Changes

If this page changes, the date at the top changes with it.