Fohrkast » Trust

Scanner requirements

Version 2026-11-07 Updated 7 Nov 2026

The scanner runs on a machine in the business's own network. This page says what that machine needs, what the scanner reads and what it sends.

On this page

  1. 01 What the machine needs
  2. 02 What it reads and sends
  3. 03 What it does not do
Contents 3 sections
  1. 01 What the machine needs
  2. 02 What it reads and sends
  3. 03 What it does not do

01 What the machine needs

  • » A Linux or Windows server inside the business's network.
  • » Node.js 24 LTS.
  • » An outbound HTTPS connection to Fohrkast, and a connection out to each database or file store it reads. Nothing connects in.
  • » A read only login for each database or file store, created by the business's administrator from a script the scanner prints.

Before every run the scanner confirms its key with Fohrkast, so it does not run offline. Fohrkast publishes no processor, memory or disk minimum here until test runs on ordinary office machines support one.

02 What it reads and sends

  • » fohrkast-scan runs on a server in the business's own network and reads each database or file store through a read only login that the business's administrator creates from a script the scanner prints.
  • » It transmits metadata only: table and column names, data types, the kinds of personal data found, counts and, where the database keeps query statistics, the logins and applications that read each table. Personal data values and database credentials remain on that server. Each report is checked against a fixed list of permitted fields before it is sent, and again when Fohrkast receives it.
  • » Before every run it confirms its scanner key with Fohrkast over HTTPS: the key must be live and not retired, the workspace active, the version not below Fohrkast's minimum and the file one Fohrkast released. Otherwise it reads nothing and sends nothing. A retired key stops the next run.
  • » Each release is signed with an ECDSA P-384 key (SHA-384) held in AWS KMS and used only from a person's administrator sign in; machines never sign. Every file of a release has a published SHA-384 checksum, and the release public key is in each installation package.
  • » Only signed in seats download it: a business's Administrator, privacy lead or developer, and the seats of a partner firm or distributor. Each download link is valid for 5 minutes, and each download is recorded in the workspace's log.

03 What it does not do

  • » It uses no AI. Detection is by local pattern rules.
  • » It does not send personal data values or database credentials to Fohrkast.
  • » It does not send file names.

Sections and rules cited are of the Digital Personal Data Protection Act 2023 and the DPDP Rules 2025 unless stated.