# Privacy & Data Sharing

> Details ReversingLabs' approach to data privacy, including policies and practices implemented to protect user information and ensure compliance with relevant regulations.



## Account Role Types

ReversingLabs offers two primary account roles that govern file visibility and sharing:

- **Private Account**

    - This is the default setting for all accounts on Spectra Analyze and Spectra Detect appliances.
    - Uploads are private by default; other ReversingLabs customers can see analysis metadata but **not** file contents or dynamic artifacts (dropped files, PCAPs, memory dumps).
    - Public instances (e.g., `https://a1000.reversinglabs.com/`) and Spectra Intelligence accounts may differ.

- **Public Account**

    - Files and dynamic artifacts uploaded by this account can be downloaded and viewed by other ReversingLabs customers.

Metadata accessibility also depends on the file size:

- Files 400 MB or less: all metadata is available.
- Files larger than 400 MB and smaller than or equal to 2 GB: reduced metadata set.
- Files larger than 2 GB: only file size and source info available.

**Important: If a private file is uploaded from another **public** source, it will cease to be treated as private. In this case, other ReversingLabs customers will be able to download the file.**


## Data Residency

For organizations with strict data residency requirements, Spectra Analyze can be deployed on-premise as a hardware appliance or virtual machine (OVA), keeping all file data within your infrastructure. Cloud-hosted deployments can be provisioned in specific AWS regions.

Spectra Intelligence cloud queries only transmit file hashes, never file contents. This ensures that sensitive file data remains within your control while still benefiting from ReversingLabs threat intelligence.

## File Retention

### Spectra Analyze Appliances

On Spectra Analyze appliances, file retention is managed locally by the administrator. Files remain on the appliance until manually deleted or until storage limits trigger automatic cleanup based on configured policies.

Administrators have full control over retention policies and can configure automatic purging based on age, storage capacity, or other criteria.

### Spectra Intelligence Cloud

Spectra Intelligence cloud retains file metadata and analysis results indefinitely to build comprehensive threat intelligence. This persistent storage enables historical analysis and improves detection of emerging threats.

For specific data retention policies related to your deployment, contact ReversingLabs support.

## Compliance and Security Certifications

ReversingLabs maintains security certifications and compliance documentation for enterprise customers. The company adheres to industry-standard security frameworks to ensure the protection of customer data and maintain trust.

For specific compliance information including SOC 2, GDPR, and other regulatory frameworks, contact your ReversingLabs account representative or visit the ReversingLabs Trust Center.

## Spectra Intelligence

### Files

Files can be submitted to Spectra Intelligence using the [TCA-0202 / TCA-0203 File Upload](https://docs.reversinglabs.com/SpectraIntelligence/API/Automation/tca-0202-0203/) service.

| Account Role | [Access to file content](https://docs.reversinglabs.com/SpectraIntelligence/API/Automation/tca-0201) | [Access to analysis results (metadata)](https://docs.reversinglabs.com/SpectraIntelligence/API/FileThreatIntel) | [Reanalyze](https://docs.reversinglabs.com/SpectraIntelligence/API/Automation/tca-0205) |
| ------------ | ---------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- |
| Public       | Yes                                                                                                  | Yes                                                                                                             | Yes                                                                                     |
| Private      | No                                                                                                   | Yes                                                                                                             | Yes                                                                                     |

### URLs

URLs can be submitted to Spectra Intelligence using the [TCA-0404 Analyze URL](https://docs.reversinglabs.com/SpectraIntelligence/API/NetworkThreatIntel/tca-0404) service.

#### Data Handling and Privacy Considerations

- **Public Resource Requirement**: [TCA-0404 Analyze URL](https://docs.reversinglabs.com/SpectraIntelligence/API/NetworkThreatIntel/tca-0404) can only access and analyze publicly reachable online resources.
- **Public Data Treatment**: All submitted URLs and downloaded files are treated as public and will be visible and accessible to all Spectra Intelligence users.
- **URL Normalization**: URL normalization is performed during request submission, which may automatically remove or convert duplicate and empty elements in the URL.

**Warning: Privacy Recommendations**
To protect potentially sensitive information when using URL analysis services:

- **Remove Personal Identifiers**: Strip any personal identifiers, session tokens, or user-specific parameters from URLs before submission
- **Avoid Internal URLs**: Do not submit URLs containing internal network addresses, private IP ranges, or intranet resources
- **Review URL Parameters**: Remove or sanitize query parameters that may contain sensitive data such as:
  - User IDs or account numbers
  - Authentication tokens or session identifiers
  - Personal information (names, emails, phone numbers)
  - Proprietary or confidential data
- **Use Generic Examples**: When possible, use generic or anonymized versions of URLs for analysis
- **Organizational Policy**: Ensure URL submissions comply with your organization's data privacy and security policies

## Spectra Analyze

| Account Role           | [Reanalyze file](https://docs.reversinglabs.com/SpectraAnalyze/search-page/#local-sample-actions) | [Threat intelligence](https://docs.reversinglabs.com/SpectraAnalyze/search-page/#threat-intelligence-cards) | [Submit for Dynamic analysis (RLCS)](https://docs.reversinglabs.com/SpectraAnalyze/dynamic-analysis/) |
| ---------------------- | ------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- |
| Public                 | Yes                                                                                               | Yes                                                                                                         | Yes                                                                                                   |
| Private (Local sample) | Yes                                                                                               | Yes                                                                                                         | Yes                                                                                                   |
| Private (Cloud sample) | No                                                                                                | No                                                                                                          | No                                                                                                    |

- If a locally available file is not uploaded to Spectra Intelligence, it will only be accessible to other users of the appliance.
- **Hash Lookups**: If Spectra Intelligence is enabled on the appliance, Spectra Analyze will query the cloud using only the file hash to check if the file is already known to ReversingLabs, enriching the local file reputation data. 
- **Threat Intelligence** lookups are performed by searching for a sample’s threat name rather than its hash.
- **Reanalyze Option**: Users have the option to manually reanalyze the file, with checkboxes to upload it to Spectra Intelligence or ReversingLabs Cloud Sandbox. These both require file to be uploaded to the cloud, if it's not already available to ReversingLabs from another source. Once uploaded to Spectra Intelligence, files will be treated according to the account role, which is private by default.
- **Automatic Uploads**: Administrators can enable automatic uploads for all analyzed files.
- Check the [Dynamic Analysis](#dynamic-analysis-in-reversinglabs-cloud-sandbox-rlcs) section below for more information on ReversingLabs Cloud Sandbox

## Spectra Detect

- Spectra Detect doesn't store files, so local files will only be accessible to users who have access to file ingress/egress storage locations configured on the appliance.
- **Hash Lookups**: If Spectra Intelligence is enabled on the appliance, Spectra Detect Workers will query the cloud using file hashes to check if the file is already known to ReversingLabs, enriching the local file reputation data.
- If **Deep Cloud Analysis** is enabled, samples will be automatically uploaded to the cloud for in-depth analysis. Once uploaded to [Spectra Intelligence](#spectra-intelligence), files will be treated according to the account role, which is private by default.

## Dynamic Analysis in ReversingLabs Cloud Sandbox (RLCS)

The ReversingLabs Cloud Sandbox is accessible through Spectra Analyze, or using the [TCA-0207 Dynamic Analysis](https://docs.reversinglabs.com/SpectraIntelligence/API/DynamicAnalysis/tca-0207) service. It is a dynamic analysis service that also respects the configured account role. If a sample is private, other ReversingLabs customers will only be able to access the analysis results, but not the actual file content, dropped files, PCAP files, or memory string dumps.

| Account Role    | [Retrieve Report (without artifact links)](https://docs.reversinglabs.com/SpectraIntelligence/API/DynamicAnalysis/tca-0106/#privacy) | [Retrieve Report (with artifact links)](https://docs.reversinglabs.com/SpectraIntelligence/API/DynamicAnalysis/tca-0106/#privacy) |
| --------------- | ------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------- |
| Public account  | Yes                                                                                                                                  | Yes                                                                                                                               |
| Private account | Yes                                                                                                                                  | Sample uploader only                                                                                                              |

## File Inspection Engine

The File Inspection Engine downloads a local threat database to classify files. It does not have the capability to upload files to ReversingLabs systems.

- **Cloud Hash Lookups:** If the application is configured to provide additional threat details (`--with-threat-details / RL_WITH_THREAT_DETAILS`) for malicious (and suspicious, when paranoid mode is enabled) files, it will query the cloud using only the file hashes.
