Privacy Policy
Threatmatic Agent
Effective date June 11, 2026
Operator:Threatmatic Inc. (“Threatmatic”, “we”, “us”) · Contact: support@threatmatic.com
The Threatmatic Agent (“the App”) is an enterprise zero-trust network access client. It establishes an authenticated WireGuard tunnel from the user's device back to the network resources that the user's employer (the “Customer”) has authorised.
This policy describes what data the App collects, why it collects it, where it is sent, and how long it is retained. The App is not a consumer service — it is provisioned by the Customer's IT or Security team, and access is gated by an API key issued by that team.
1. Data the App processes
The App processes the following categories of data on the device:
| Category | Examples | Purpose |
|---|
| Authentication credentials | API key (entered once by the user during Configure) | Authenticate the device to the Customer's Threatmatic engine. Stored locally only; never transmitted in plaintext outside the TLS-protected gRPC channel to the Customer's engine. |
| Device identifier | Device name (e.g. the user-set Bluetooth/AirDrop name or hardware model), a per-install device id assigned by the engine | Identify the device in the Customer's admin console so the Customer can manage access. |
| Network identity | Public IP address (as observed by the Customer's engine), WireGuard public key generated on the device | Establish and maintain the tunnel. The private key never leaves the device. |
| organization identifier | The organization id derived from the API key | Scope policy and routing to the correct Customer tenant. |
| Operational telemetry | Connection state, tunnel up/down events, error codes | Diagnose connectivity issues. No payload data, browsing history, DNS queries, or user activity is logged. |
The App does not collect, process, or transmit:
- Web browsing history
- Application usage statistics outside the tunnel state
- Location data
- Contacts, photos, files, microphone, or camera input
- Financial information
- Health data
- Advertising identifiers
2. How data is transmitted
- All control-plane traffic between the App and the Customer's Threatmatic engine is encrypted with TLS over gRPC.
- All data-plane traffic between the App and the Customer's resources is encrypted end-to-end with WireGuard (Noise protocol, ChaCha20-Poly1305, Curve25519).
- The App does not transmit data to any party other than the Customer's own Threatmatic engine. Threatmatic Inc. does not operate a multi-tenant cloud that receives Customer traffic.
3. How data is stored
- The API key and organization id are stored in the App's private files directory, encrypted at rest using a per-install key.
- WireGuard private keys are stored in the App's private files directory and never transmitted off the device.
- The Customer's engine retains device records (device id, name, public IP, public key, connection state) according to the Customer's own retention policy. Contact the Customer's IT or Security team for that policy.
4. Data sharing
Threatmatic Inc. does not sell, rent, or share user data with third parties. The App communicates only with the Customer's Threatmatic engine, which is operated by the Customer's own IT or Security team on infrastructure they control.
5. Permissions the App requests
- VPN service (BIND_VPN_SERVICE) — Required to establish the WireGuard tunnel. The App uses Android's standard VpnService API; the user explicitly grants consent on first connect and may revoke it at any time from system settings.
- Foreground service (FOREGROUND_SERVICE, FOREGROUND_SERVICE_SYSTEM_EXEMPTED) — Keeps the tunnel alive while the App is not in the foreground.
- Boot completion (RECEIVE_BOOT_COMPLETED) — Restores the tunnel after a device reboot, provided the user has not previously tapped Stop.
- Network state (ACCESS_NETWORK_STATE, INTERNET) — Required to detect network changes and reach the Customer's engine.
- Notifications (POST_NOTIFICATIONS) — Used solely for the ongoing connection-status notification mandated by Android for foreground services.
6. User controls
- Stop — The user can tap Stop in the App at any time to tear down the tunnel and disable autostart.
- Reset — Clears the locally stored API key and organization id from the device. Authentication credentials must be re-entered to use the App again.
- Uninstall — Uninstalling the App from the device removes all locally stored data, including credentials and WireGuard keys.
- Account deletion — To request deletion of the device record from the Customer's engine, contact the Customer's IT or Security team or write to support@threatmatic.com and we will route the request.
7. Children
The App is intended for use by employees of the Customer in their professional capacity. It is not directed at children under 13 (or the equivalent minimum age in the user's jurisdiction).
8. Changes to this policy
We will update the effective date above when this policy changes materially. Continued use of the App after a change constitutes acceptance of the revised policy.