Skip to main content
Updated October 15, 2026 Raff Guardian reads the state of Windows, not your data. It sends Raff what it needs to look after the server: health, updates, security settings, sign-ins and the apps installed. This page lists what that is, what it never reads, and who can see it.

​
How it works

​
What it sends, and how often

Every minute the agent sends a signed report over HTTPS to api.rafftechnologies.com. Only what changed goes each minute; everything is sent again every 15 minutes. Some checks run less often, noted below. The agent also reports the start and result of every action, with what it was before and after.

​
What it never reads or sends

  • Your files. The Disk space by folder question adds up folder sizes from directory listings and never opens a file. Inside user profiles it names only standard folders such as Desktop, Documents and Downloads.
  • Passwords. No account password, and not the auto sign-in password: Raff Guardian only checks whether one is set. A new password you ask for is sealed to your browser, and Raff cannot open its copy.
  • Account details beyond those listed above: never an account’s comment, full name or bad-password count.
  • Your product key, beyond its last 5 characters.
  • Microsoft Defender exclusions. It counts them and never lists them.
  • Per-user programs. The app list covers programs installed for the whole server. Paths inside user profiles are masked, for example C:\Users\*\....
  • The Security event log, through a question. The Recent errors question reads only the System and Application logs.

​
Questions you ask

The Check your server now card on the Overview asks Raff Guardian a read-only question, such as What uses the CPU or Ports and connections. A question only reads; nothing changes. Answers leave out command lines, program paths and account names, mask secrets they recognise in event messages and task names, and are deleted after 7 days. Only members who can manage the server can ask and read them. You can switch questions off with Answer questions about this server in the Commands group of the per-action settings.

​
What stays on the server

The agent keeps a copy of its own reports for 7 days in C:\ProgramData\Raff\Guardian, which only Administrators and the system account can read, and writes its log to the Windows Application event log.

​
Who can see it

  • Members of the project with permission to view the server see Raff Guardian’s reports, findings and activity. Answers to questions, exports and new passwords need permission to manage the server.
  • Raff staff cannot open your server’s Raff Guardian pages through Raff’s own tools or admin access.
  • When you delete a server, its Raff Guardian activity is hidden from the dashboard at once.

​
When to use it

  • Before installing Raff Guardian on a server that holds sensitive data, to know what leaves the server.
  • When your security team asks what the agent collects.

​
Trade-offs / limits

  • Raff Guardian sends account names, administrator names and the IP addresses of sign-ins and sessions. It needs them to block attackers, show who is signed in and warn about new administrators.
  • Secret masking in question answers recognises common patterns (passwords in connection strings, tokens, email addresses). It is not a guarantee that no secret ever appears in an answer.
  • When a check fails, its error report can include part of Windows’ own error message.

How it works

The agent, its key and signed releases.

Activity

What Raff Guardian records about its own work.
Last modified on October 16, 2026