Security
Where the line is, and who is responsible for each side of it.
Most of what matters here follows from one decision: the appliance runs on your infrastructure. It tells us which version it runs and which licence it holds, and the update request it uses to do that refuses the fields that would carry your operational data. Anything beyond that leaves your network only because you configured it to.
Your side of the line
What stays on your network, and what control you keep over anything that leaves it.
- Your credentials stay with you
- The device and server credentials the appliance uses are held on the appliance, on your hardware. There is no copy on our side and no endpoint here that would accept one.
- The update request carries no operational data
- The appliance does send us something: which version it runs and which licence it holds, because we cannot tell it whether an update applies without knowing that. What the request cannot carry is your operational data. Device counts, hostnames, addresses, topology, syslog and configuration are refused by the format of that request itself, so it is not a matter of us choosing not to read them.
- What leaves your network, you configured
- Where you configure an outbound destination, the appliance posts to it directly, from your network to the address you set. A remote support session happens only when somebody in your organisation approves that specific session, and it expires on its own.
- Licensing works without a connection
- Where your network has no outbound route, licensing and updates move as signed bundles you carry in, and the signature is verified locally rather than by asking us. Enterprise licences include that delivery route.
Our side of the line
What we hold is commercial: your organisation, your subscription, your licences and your support history. This is how that is protected.
- Records are separated by organisation
- Every record we hold belongs to one organisation, and the database applies that restriction to queries in its own right rather than relying only on the application to ask correctly. It is a second control behind the first, not a guarantee against every possible fault.
- Access is decided on the server
- What you can see and do is determined when your request reaches us, by one shared check, whatever route the request took. The interface reflects that decision rather than being the thing that makes it.
- Sensitive actions ask again
- Issuing a licence, publishing a release, changing what someone is allowed to do, or authorising support access all require a recently confirmed second factor rather than just a live session.
- The audit trail is tamper-evident
- Audit entries are chained together, so altering or removing one can be detected by recomputing the chain. This means you can tell whether the record has been changed. It is evidence of tampering, not a guarantee that tampering is impossible.
- Signing keys are held apart
- The private key that signs a licence is not present in the web application or its database. Only the public half, which is all that is needed to verify a signature, is stored here.
What stays your responsibility
The boundary that protects your data also means some of it is yours to look after. This is the part we cannot do for you.
- The credentials you give the appliance
- The appliance holds credentials for your devices and servers. Scoping those accounts to what it actually needs, and rotating them, is yours to manage. We never receive them and cannot rotate them for you.
- Who you let into the console
- Operator accounts on your deployment are administered by your organisation. We do not create, approve or remove them.
- Anywhere you send alerts
- If you configure the appliance to post to a third party, what happens to that data once it arrives is between you and that provider. It does not pass through us and we cannot see it.
- The server it runs on
- Patching, hardening and backing up the host is yours, as it would be for anything you run on your own infrastructure.
Reporting a security problem
If you have found a security problem in PureView or in this site, tell us and say in the first line that it is a security report, so it is routed quickly.
Include enough detail to reproduce it. Please do not send live credentials, customer data or anything from a production appliance.
Put this in front of your security team
If they have questions the page does not answer, send them to us directly. Specific questions get specific answers.