EventLens-Public/docs/PRIVACY.md

Privacy model

Windows Event Logs frequently contain usernames, hostnames, IP addresses, e-mail addresses, executable paths and application-specific fields.

In-memory workflow

1. The browser sends the selected .evtx to the self-hosted API.
2. A receive-level request gate rejects oversized body streams before multipart parsing; the API then reads bounded chunks, parses bytes off the event loop and returns normalized JSON.
3. EventLens does not create an application-level upload file or database record.
4. The multipart parser may transiently spool request data as part of the web framework; the upload handle is closed after every request and the app does not retain that path.
5. The browser keeps the normalized analysis in component memory for the current session; switching workspaces does not create another copy or upload it elsewhere.
6. Only display preferences (timestamp mode, defaults, density and preferred workspace) may be stored in the single eventlens.preferences.v1 localStorage record; event text, EVTX-derived values and analysis results are never stored there. The Settings workspace labels this boundary directly, exposes its technical key only on request and can reset the record to defaults.
7. Export is generated locally in the browser.
8. The favicon, touch icons and web manifest are static files bundled with EventLens. They make no third-party request, do not enable a service worker and do not persist investigation data.

Redaction before export

Redaction is enabled by default and operates on a cloned analysis object. It masks or replaces:

• computer/host values;
• username/account/e-mail identity fields, including domain-qualified accounts, SIDs and machine accounts;
• e-mail addresses in free text;
• IPv4 and IPv6 addresses in free text or IP-address fields;
• Windows and UNC paths (including spaces/parentheses) and path-like fields;
• source-name fields and source values propagated into free-form text;
• known structured identities propagated into summaries, incident titles and reasons;
• the source filename in the exported report.

The UI previews replacement counts by type before export. The original in-memory analysis is never modified by the redaction function. The source name is replaced with [REDACTED_SOURCE].evtx when redaction is enabled. JSON and Markdown carry the same redacted normalized analysis and parse-completeness metadata.

Redaction can be disabled when a raw forensic export is explicitly required, but that is an explicit user choice and the warning remains visible.

Limits

The API enforces a 50 MiB file limit, a bounded request body independent of Content-Length, parser event/time budgets, bounded normalized strings/fields/output and bounded parse concurrency. These controls reduce accidental resource exhaustion; they are not a guarantee against every parser implementation vulnerability.

Redaction is a best-effort privacy layer, not a formal DLP engine. Application-specific free-form values may contain sensitive data that cannot be inferred safely. Review exports before sharing them outside the intended context.