Your URLs never leave your network
LinkScout is designed for organisations where internal URL visibility is a security concern. This document explains the architecture and data handling for compliance review.
1. Architecture Overview
LinkScout uses a split architecture that separates monitoring from data storage:
Self-hosted Agent
Runs inside your network as a Docker container or Node.js process. It connects to your internal URLs, performs HTTP checks, and transmits only hashed results to the LinkScout cloud API.
Cloud Dashboard
Hosted SaaS dashboard that receives hashed check results and displays link health, response times, SSL status, and alerts. It never sees or stores actual URLs.
The agent initiates all connections — there is no inbound access to your network required. The agent communicates outbound to the LinkScout API over HTTPS (TLS 1.2+).
2. Data Flow & Hashing
Before any data leaves your network, the agent applies SHA-256 hashing to sensitive fields:
// URL hashing — the actual URL is never transmitted const url_hash = SHA256(url) // e.g. "sha256:a1b2c3d4..." // Content hashing — page body is hashed, not sent const content_hash = SHA256(body) // detects changes without exposing content
What the agent transmits per check:
| Field | Value | Reversible? |
|---|---|---|
| url_hash | SHA-256 of the URL | No |
| status | HTTP status code (200, 404, etc.) | N/A |
| response_ms | Response time in milliseconds | N/A |
| ssl_days_remaining | Days until SSL certificate expiry | N/A |
| content_hash | SHA-256 of the response body | No |
| checked_at | ISO 8601 timestamp | N/A |
SHA-256 is a one-way cryptographic hash function. Given a hash, it is computationally infeasible to recover the original URL or content. The cloud dashboard can detect broken links and content changes by comparing hashes, without knowing the underlying data.
3. Agent Security Model
Network access
The agent requires outbound HTTPS access to the LinkScout API. No inbound ports need to be opened. The agent does not listen on any port.
Credential handling
If your internal URLs require authentication (bearer tokens, basic auth), these credentials are stored only in your local YAML config file. They are used by the agent to connect to your endpoints and are never transmitted, hashed or otherwise. The agent strips all response headers before hashing.
API key
Each agent authenticates with the cloud API using a unique API key (prefixed ls_). The key is SHA-256 hashed at rest — even the cloud database stores only the hash. A compromised database cannot be used to impersonate an agent.
Open source
The agent source code is available on GitHub for security review. Your team can audit every line of code that runs inside your network. The Docker image builds directly from this source with no additional dependencies beyond Node.js.
4. Audit Mode
Run the agent with --audit to see exactly what would be transmitted without sending anything:
$ npx linkscout-agent --config config.yml --audit
LinkScout Audit Report
════════════════════════════════════════
Target: Intranet Portal (https://intranet.corp.example.com)
Status: 200
Response: 142ms
SSL Expiry: 89 days
Body: 24,531 bytes → hashed to sha256:7f83b1657...
What would be transmitted:
url_hash: sha256:e3b0c44298... (irreversible)
content_hash: sha256:7f83b1657... (irreversible)
status: 200
response_ms: 142
ssl_days_remaining: 89
No data was transmitted. This report is local only.We recommend running audit mode during your initial security review so your team can verify the data boundary before connecting to the cloud API.
5. Data Stored in Cloud
The cloud dashboard stores the following data:
Stored
- SHA-256 URL hashes
- HTTP status codes
- Response times
- SSL expiry days
- SHA-256 content hashes
- Timestamps
- Agent metadata (name, heartbeat)
- User-provided target labels
Never stored
- Actual URLs
- Page content or HTML
- Response headers
- Authentication credentials
- Cookie values
- IP addresses of targets
- DNS records
- Internal hostnames
Target labels are optional identifiers you set from the dashboard (e.g. "HR Portal", "API Gateway"). They are human-readable names to help you identify hashed URLs. If your policy prohibits even descriptive labels, leave them blank — the dashboard will show truncated hashes instead.
6. Authentication & Access Control
User authentication
Dashboard access uses email/password authentication via Supabase Auth. Sessions use JWT tokens with ES256 signing verified against JWKS. All API endpoints validate the JWT before returning data.
Row-level security
All database tables enforce row-level security (RLS). Each user can only access their own agents, checks, alerts, and history. This is enforced at the database level — even a compromised API cannot access another user's data.
Agent API keys
Agent API keys are 64-character hex strings with an ls_ prefix. They are shown once at creation and stored as SHA-256 hashes. Each agent key is scoped to the creating user.
7. Infrastructure
Hosting
The dashboard and API are hosted on Vercel's edge network. Data is stored in Supabase (PostgreSQL) hosted in AWS. All connections use TLS 1.2 or higher.
Data residency
Database is hosted in the Supabase default region. Contact us if you need a specific data residency arrangement for your compliance requirements.
8. Compliance Considerations
LinkScout's architecture is designed to simplify compliance review:
ISO 27001
The hashing architecture means that internal URL data is never processed or stored outside your network perimeter. The cloud component processes only non-reversible hashes, which may fall outside the scope of data classification policies that apply to URLs and page content.
SOC 2
The audit mode provides a verifiable record of exactly what data crosses the network boundary. The agent source code is open for review. API keys are hashed at rest.
GDPR / Privacy
SHA-256 hashes of URLs are not considered personal data under standard interpretations, as they cannot be reversed to identify individuals. If your URLs contain PII (e.g. user IDs in path segments), the hashing ensures this data never reaches our infrastructure.
Questions?
If your security team needs additional information or a live walkthrough of the architecture, contact us directly.
Contact Security Team