Skip to main content
kombify Guard reports a small, fixed set of facts about your server so Techstack can show its health, security state and operation results. This page lists those facts, says where they go and for how long they are kept, and names what Guard never sends.
Techstack is pre-1.0 and connected operation is preview scope; see availability. Retention below is what the current release enforces. Where a window is not listed, it is not yet confirmed and this page does not state one.

​
Where the data goes

  • Self-managed Techstack: Guard reports only to your own Techstack. kombify receives nothing unless you connect that installation.
  • Connected or managed: Guard reports to the kombify-operated Techstack over its authenticated, key-bound connection (see pairing a server).
Guard always connects outward over HTTPS. You do not open an inbound port for it. Every report is tied to your account at ingest, and every read is scoped to it: no customer can read another customer’s hostnames, addresses or metrics.

​
What Guard reports

Guard collects resource figures about every 30 seconds by default, and asks the host for a fresh security observation about every 15 minutes. Observing the host changes nothing on it. One more class is opt-in. If a smart-home automation on the server is set up to notify you, Guard forwards only the notice text its author wrote (at most 280 characters) so it can reach you as a notification. It is off by default, is turned on per automation, and never sends entity states, presence, locks, cameras or sensor history.
Metrics and label names are an allowlist enforced twice, on the server before anything is stored locally and again when the data arrives. A value that is not on the list is dropped, so a misbehaving collector cannot widen what leaves your host.

​
What Guard never sends

  • Application content: the files, databases, messages or photos your services hold.
  • Environment variables, secrets or credentials of your applications.
  • Personal data of the people in your household.
  • The owner’s email address. It is StackKits configuration, not Guard data.
Application content reaches kombify only through a separate, read-only component with its own consent model, never through Guard’s connection, spool, receipts or logs.

​
How long it is kept

After an outage Guard sends what it queued, oldest first. A gap is reported explicitly and is never silently filled.

​
What happens to the data when you detach a server

Detaching a server revokes its credentials and ends its remote reach, as described in revoke and detach. On the server, Guard then deletes its identity key, its credential, its queued telemetry and the operation records Techstack has acknowledged. The server’s record stays in Techstack as a detached record with its audit trail, and history that has already been collected ages out under the windows above. The data contract also sets a target of removing a detached server’s inventory, metrics and posture within 30 days. This release does not yet confirm that automatic removal, so it is not stated here as a guarantee.

Pair a server

How a server becomes bound to you, and what you see while it does.

Revoke, detach and uninstall

End a server’s access and remove Guard from the host.