Privacy implications of using the Enterprise edition as a selfhosted user

[Viable8237]

Hello,

I was checking out Pangolin's Enterprise edition but I have some privacy related concerns. I would say my questions are mostly aimed at @miloschwartz / @oschwartz10612 but any answer is welcome of course.

I noticed that in order to get the Enterprise license, one needs to enter their name and surname even if they only want it for personal (selfhosted) use. Why does Fossorial need this information? Would not just an e-mail address suffice?

Also what other privacy implications (if any) does using the Enterprise edition as a selfhosted user have compared to the Community one? As an example will Fossorial be able to see information (e.g. an IP address) about the server a user runs Pangolin on once the license is activated? Would it be possible for Fossorial to access any usage data of the selfhosted instance/track the instance and its users? etc.

Thank you!

[oschwartz10612]

Hello! For transparency we request that information to try to dissuade fraud. If you know you have to enter information - even bogus information - people may be less likely to do so. The CE and EE both have telemetry. You can read more about that here and how to turn it off: https://docs.pangolin.net/self-host/telemetry#telemetry No other information is collected from the enterprise edition from the CE. Outside of the telemetry we can see the source IP of the server making license requests to the API.

[Viable8237]

Thank you @oschwartz10612!

Outside of the telemetry we can see the source IP of the server making
license requests to the API.

What do you mean by "making license requests to the API" please? Do you mean you can see the IP of the device used for generating the license or activating it?

[oschwartz10612]

Pangolin needs to reach out to our API to validate the license. It presents the key and the server says "yes this is valid" or "not it is not". This happens every 6 hours or so. Naturally like any API on the internet we can see the source IP of this request. The instance is only ideitnfied in the system by the instance name/id which you can see on the licnese page.