The core guarantees
No organization identity
The anonymized intelligence layer stores only aggregate counts and signals. It contains no organization identifiers — there is no field that maps a signal back to a customer.
k-anonymity (3+ orgs)
Cross-customer data is only ever surfaced for an entity observed by at least 3 distinct organizations. Anything seen by one or two is never reported.
How anonymization works
Aggregate, never per-customer
The intelligence powering Intel is computed as platform-wide aggregates. For a given IP, ASN, or fingerprint, Flarehawk stores values like “how many distinct organizations observed it”, “how many events were blocked”, and “which attack categories appeared” — as totals across the platform. It does not store, and cannot return, a per-organization breakdown.The k-anonymity threshold
Every aggregate is gated at the source: an entity is only written into the intelligence layer if 3 or more distinct organizations have observed it. The “seen across N organizations” figure you see in a lookup is therefore always at least 3. Entities below that threshold simply don’t appear — which is why some lookups return external enrichment but an empty platform panel.Per-value anonymization for details
The threshold protects the entity, but Flarehawk goes further to protect the details. Potentially identifying values — such as targeted URL paths and user agents — are themselves filtered so that a value is only shown if it was independently observed by enough organizations. A URL path that is unique to one customer’s application will never surface through Intel, even if that customer’s traffic is part of a widely-seen IP’s activity.TLS fingerprints are not customer data
JA3 and JA4 fingerprints identify client tooling — the software making the connection — and are identical for the same tool across the entire internet. They describe the attacker’s toolchain, not any customer, which is exactly what makes them such useful, privacy-safe intelligence.What your organization contributes
Your environment’s attack telemetry contributes to the same anonymized aggregates that every customer benefits from. That contribution is subject to all of the protections above: it is aggregated across the platform, gated by the 3-organization threshold, stripped of organization identifiers, and filtered at the value level. No other customer can attribute a signal to you, see your unique paths or assets, or learn that your organization specifically was targeted.Access controls
- Entitlement-gated. The Intel page and its data are only available to organizations with the Flarehawk Intel add-on. The gate is enforced on the server for every request, not just hidden in the UI.
- Scoped to your session. Intel is always accessed in the context of an organization you already have access to.
- Audited. Every lookup is recorded in your organization’s audit log, giving you an accountable trail of who queried platform intelligence and when.
Because the intelligence layer reflects recent platform activity, entities that go quiet age out over time. Intel is designed to highlight currently relevant threats rather than maintain an indefinite history of any single source.
Frequently asked questions
Can another customer tell that my organization was attacked?
Can another customer tell that my organization was attacked?
No. Intelligence is aggregated across the platform with no per-organization detail, gated so only entities seen by 3+ organizations appear, and stripped of any organization identifier. There is no field that ties a signal back to your organization.
Will my internal URL paths or assets show up in someone else's lookup?
Will my internal URL paths or assets show up in someone else's lookup?
No. Paths and user agents are filtered with their own multi-organization threshold, so a value unique to your application is never surfaced — even when it appears on a widely-observed IP.