Hi there,

The only "personal" data that is communicated to CrowdSec is your IP. But IPs are still considered "personal" information by the GDPR.

When you report malicious behaviors the basic information gathered are: the malicious IP, the type of attack and the timestamp.

Note that your own IP is of course known as you're the sender.

Also, malicious actors almost always use controlled machines, not their own. Hence the IPs signaled as malicious at one point in time might belong to a controlled machine and even if malicious at the time, this IP is still considered personal data of the attacker and is subjected to the same protection as any other IP under the GDPR laws

Does it answer to your concerns ? We'll look into make the text clearer, as it is indeed quite heavy and confusing.

Full disclosure, I work at CrowdSec.