No phone home
Agents connect to your jvmguard server. The server makes no outbound calls. All data stays inside your network.
Security and data flow
What jvmguard does inside your JVM
This page states what the jvmguard agent collects in your JVM, where it sends that data, and what you can check in the source. For a tool that runs in production, that is the first question to answer.
§ 01Architecture
§ 02Collected by default
jvmguard records only lightweight data, at low steady-state overhead:
- Built-in scalar telemetries like heap, CPU, threads or GC
- Scalar telemetries from configured sources
- Transactions you explicitly configured
§ 03Captured on demand
Deep artifacts are not collected by default. A capture runs only when a trigger fires, or when you start one manually on a single JVM.
- A JFR recording, for a bounded duration
- A heap dump (HPROF)
- A thread dump
- A JProfiler snapshot
§ 04Operational posture
No JMX port
The agent reads MBeans in process. You do not have to open a JMX connector server on the monitored JVM to inspect or operate on MBeans.
Single H2 file
Recorded data and configuration both live in a single embedded H2 file. There is no external database to operate.
TLS for agents
Agent-to-server traffic can be encrypted and authenticated via TLS.
Three access levels
Admin, Profiler, and Viewer roles partition a single server for separate teams.
Local, LDAP, or SSO
Authentication uses locally configured accounts, LDAP, or SSO, all configurable in the UI.
§ 05License and deployment
Apache License 2.0. Sources are available. Read it, build it, and audit it with your own tooling before it touches production.
Self-hosted. Runs behind your firewall. Suitable for air-gapped networks. No outbound cloud dependency.
Single server. The collector, the embedded database, and the web UI run in one process. No separate services to secure.