Security and privacy
Your code stays on your site
To detect a change, Tocsin24 compares fingerprints. The only exceptions, set out below: public JavaScript files, read to look for card skimming, and logs if you turn on their collection. The platform and its data are hosted in Switzerland.
Your site
The read-only module computes the fingerprints and records the state of the site.
Stays here: your PHP code, your configuration files, passwords, payment data.
+ metadata
Tocsin24 platform
Compares the fingerprints with the reference, ranks and explains every incident. Application and data hosted in Switzerland.
What is sent
- Fingerprints of files and installed versions
- On Magento, the content of public JavaScript files (the pub/static folder) when they change, read to look for card skimming: Tocsin24 keeps only its verdict and, if a file is malicious, the offending excerpt.
- Scripts added in the configuration (header, footer) and suspicious excerpts from pages and content blocks
- Metadata of admin accounts, integrations and tokens (never their secrets)
- Aggregated sales and sign-up figures
- Probe results and disk space
- Access and error log lines (including Magento’s error logs), if you turn on their collection, which contain IP addresses: kept for 7 days, after which only hourly statistics are retained.
What is never sent
- The content of your PHP code and configuration files
- Passwords and payment data
- Your customers’ names, emails, addresses and orders.
On the platform
- Two-factor authentication
- Roles per instance
- Audit log
- Data hosted in Switzerland
What Tocsin24 is not
A firewall
It does not block attacks.
An automatic clean-up service
It reports and explains; the fix is carried out by a person (see Expert services).
A compliance tool
It issues no PCI DSS certification or attestation. It helps spot an unexpected change, which supports your compliance efforts without replacing them.
Questions
Can the module change my site?
No. The Magento 2 module and the WordPress plugin are read-only. The hardening checks read the configuration, without changing anything or attempting any intrusion.
Does the module slow the site down?
Not noticeably. The module answers Tocsin24’s checks, not visitors. The only exception: the built-in visit log, if you turn it on, adds one line to a file for each page served, a negligible amount of work.
How do I avoid alerts during a deployment?
Declare a deployment window in the settings, or automatically from your pipeline using the API and the instance’s token.