Data & Privacy
OSIRIS is a front end over public data sources. It does not hold an intelligence database of its own: nearly every panel answers by querying somebody else's service in real time. That has a consequence worth stating plainly, because it is easy to miss.
YOUR QUERY LEAVES THIS INSTANCE
When you look up an email address, domain or IP, that value is forwarded to the upstream provider that answers the lookup. The provider sees what you searched for, and the search itself can reveal what you are investigating. Self-hosting OSIRIS changes who operates the front end — it does not stop these outbound queries. If the subject of an investigation is sensitive, treat every lookup as disclosed to the provider listed below.
AUTOMATIC IP GEOLOCATION
Three seconds after the dashboard loads, the browser calls /api/geo. The server reads your apparent IP address from the usual proxy headers and asks an external geolocation provider where it is, so the map can open near you rather than on the middle of the Atlantic. Interacting with the page before that — a click, a key press — cancels the request and the map stays where it is. Nothing about the result is written to your account, because there are no accounts.
WHERE DATA GOES
| Service | What is sent | When |
|---|---|---|
| ipapi.co, freeipapi.com, ip-api.com | Your apparent IP address | Three seconds after the dashboard loads, to centre the map near you |
| api.xposedornot.com | The email address you search | Breach lookups |
| cavalier.hudsonrock.com | The email or domain you search | Infostealer lookups |
| internetdb.shodan.io, stat.ripe.net, rdap.org, dns.google | The host, IP or domain you search | Infrastructure lookups |
| crt.sh | The domain you search | Certificate transparency lookups |
| api.github.com | The username you search | GitHub account lookups |
| otx.alienvault.com, cve.circl.lu, cveawg.mitre.org | The indicator or CVE you search | Threat and vulnerability lookups |
| Google Gemini | The feed context you submit for analysis | AI briefing and analysis requests |
Each service applies its own privacy policy and retention to what it receives. OSIRIS does not control, and cannot undo, what an upstream provider keeps.
AI FEATURES
Briefings and correlation are produced by Google Gemini from the feed context the request carries. Do not paste confidential source material into them. A briefing is a language model's summary of its input: fluent prose is not verification, and the claims inside still need checking against the underlying feeds.
SCANNING
Active scans are rate limited, restricted to a safe subset, and blocked against private and reserved address space. That is a safety floor, not permission: scanning infrastructure you are not authorised to test may be unlawful where you or the target are located, and authorisation remains yours to obtain.
Last reviewed against the codebase: 15 September 2026.