Cloud or private: choosing a mode
Every device runs in one of two modes, cloud or private. The protection on the machine is identical in both; the mode decides what leaves the machine and whether incidents show up in the console. This page is the choice and its practical consequences.
The protection is the same
Mode is an egress and management choice, not a protection level:
- Same evaluation: the change is scored by the local model on the device in both modes.
- Same enforcement: watching, scoring, user confirmation prompts and reversible roll-back run identically.
- Different egress: the mode only changes what leaves the machine and what the console can show.
Cloud versus private
| Dimension | Cloud | Private |
|---|---|---|
| Where a change is evaluated | Local model on the device | Local model on the device (identical) |
| What leaves the machine | Redacted incident metadata, reported continuously | At most one request every 30 days; opt-in analytics only |
| Incidents in the console | Yes: quarantines and audit are reported and reviewable | No: nothing is reported, decisions stay on the device |
| Remote second opinion | Optional dual evaluation is available | None: no evaluation call leaves the machine |
| Self-update | Periodic poll | Folded into the monthly contact |
How the mode is set
The mode is a property of the device on your account, not an installer flag:
- Set on the account: the mode comes from the device's enrollment record and is delivered in the enroll response.
- Persisted locally: the daemon stores it in a
devicemodefile and reads it on every start. - No environment switch: there is no install-time flag or variable that changes the mode, and there is no
PZ_MODE.
What private guarantees
A private device throttles every network poll to one request per month and never reports incidents:
- No incident reporting: a private daemon never sends quarantine reports or fetches decisions.
- One monthly contact: the update check and license check-in are bundled into a single request roughly every 30 days.
- Opt-in analytics only: nothing is sent on suspicion; aggregate analytics leave only if you switch them on.
Choosing
| Choose | When |
|---|---|
| Cloud | You want a central console view of incidents across a fleet, and continuous redacted reporting is acceptable |
| Private | You want nothing to leave the machine beyond a monthly contact, and you manage incidents locally |
Read next
The exact cloud data contract: what Cloud mode sends. The full egress allowlist: network and firewall requirements. What a cloud device records: incidents and audit.
Same protection, your choice of what leaves the machine.
Cloud for a central console view, private for a single monthly contact. Free for Linux, macOS and Windows.
Sign me up