> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safesquid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Files and Folders

> SafeSquid SWG server path reference for service control, policy storage, runtime data, logs, audit evidence, backup, and rollback.

# Locate SafeSquid Files and Folders

SafeSquid server paths are part of the enforcement boundary. They hold service control scripts, module binaries, policy XML, and activation material. They also hold SSL data, reporting databases, signature stores, runtime files, and logs. Uncontrolled edits can break proxy availability, weaken inspection, erase rollback evidence, or create audit gaps.

Use this section to prove what changed, locate operational evidence, and decide which files need change control. Do this before an upgrade or incident response.

## Control the file surface

Treat these paths as production controls, not ordinary local files:

| Path group | Control value | Primary risk |
| - | - | - |
| Service and startup files | Prove how SafeSquid starts, restarts, and tunes the host | Unapproved runtime changes or service outage |
| Binaries and modules | Load SafeSquid features and interface section definitions | Missing modules, mismatched libraries, or unsupported edits |
| Policy and security files | Store activation, policy, SSL, SQLite, and UI assets | Policy drift, certificate exposure, or support risk |
| Runtime data and signatures | Store cache, temporary files, databases, and downloaded signatures | Stale data, failed updates, or lost reporting history |
| Logs and PID state | Preserve audit, forensic, performance, and runtime evidence | Missing incident evidence or incorrect process state |

## Protect sensitive evidence

Activation files, SSL folders, policy XML, reporting databases, and SafeSquid logs contain security-sensitive data. Logs can include user identifiers, source IP addresses, destinations, policy outcomes, browser metadata, and investigation context.

Before exporting or sharing evidence, redact personal data unless an approved audit or incident investigation requires it. Retain copied files according to your organization's evidence-handling policy.

## Use change control

Do not edit SafeSquid-controlled files directly unless a documented procedure requires it. Record the path, owner, reason, backup location, reviewer, and rollback step. Do this before changing service scripts, startup parameters, policy XML, SSL material, modules, templates, or log settings.

For policy work, prefer the SafeSquid interface. File-level edits should be reserved for recovery, support-directed remediation, or documented administrative tasks.

## Locate the right path

| Need | Start here |
| - | - |
| Verify service controls, startup behavior, TCP tuning, log rotation, Monit, PAM, or kernel tuning | [Service and Startup Files](/architecture/files_and_folders/service_and_startup_files.md) |
| Understand binaries, modules, section XMLs, and default startup or setup files | [Application Binaries and Modules](/architecture/files_and_folders/application_binaries_and_modules.md) |
| Locate activation, policy, SSL, SQLite, UI, CGI, template, CSS, JS, image, or font files | [Policy, Security, and UI Files](/architecture/files_and_folders/policy_security_and_ui_files.md) |
| Review temporary data, cache, report databases, SSL certificate cache, user data, and signature stores | [Runtime Data and Signatures](/architecture/files_and_folders/runtime_data_and_signatures.md) |
| Collect config, extended, native, performance, privacy, and process evidence | [Logs and Audit Evidence](/architecture/files_and_folders/logs_and_audit_evidence.md) |

## Minimum incident set

For an operational incident, preserve:

1. affected user, source IP, destination, and timestamp
2. matching report entry or SIEM event
3. relevant `extended.log`, `native.log`, `performance.log`, or `config.log` lines
4. recent configuration backup files
5. service state and startup parameters
6. Monit, BIND, and NTP health status
7. SafeSquid process ID from `/var/run/safesquid`

## Next steps

* Use [Logs and Audit Evidence](/architecture/files_and_folders/logs_and_audit_evidence.md) to collect proof for investigation and audit.
* Use [Support](/architecture/policy_management_console/support.md) to prepare escalation evidence.
* Use [Policy, Security, and UI Files](/architecture/files_and_folders/policy_security_and_ui_files.md) to locate policy, security, and UI files.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.