Security
It runs on your hardware.
No vendor cloud, and no account that holds your data. This page says what NetEnds stores, what it sends and when, and how to check a release. Most of it you can confirm from your own firewall log and terminal.
Your server, your data
One Linux host, and it’s yours.
NetEnds installs on a single Linux host you own, bare metal or a VM, running Docker. Your inventory, configs, credentials, metrics, logs and flows are stored there, in databases that answer only on the host itself. There’s no NetEnds cloud for them to sync to.
No agent software runs on your nodes. NetEnds reads them over SNMP, SSH and their own management APIs.
- Credentials
- Encrypted at rest, with a key generated on your host when NetEnds is installed.
- Web access
- HTTPS by default, with TLS 1.2 and 1.3. Port 80 redirects to it. The installer creates a self-signed certificate, and
netends-tls installswaps in your own. - Gia’s model
- Runs in a container on the same host and publishes no port.
- Support files
- A support bundle is a file you download and decide whether to send. Secrets are left out, and IP and email addresses are masked unless you opt in.
What it sends, and when
What goes out, when, and how to switch it off.
Your firewall log will show each connection below. If it shows one this page doesn’t explain, tell us at support@netends.com.
On by default
The NetEnds database runs PostgreSQL with the TimescaleDB extension, and that extension ships with its maker’s usage report switched on. Shortly after the database starts, and on a schedule after that, when the host can reach the internet, it sends its maker the software versions, operating system details, the number and size of database tables, which database features and functions are in use, counts of its background jobs and errors, and random identifiers for the database. It carries no rows of your data.
This command on the host turns it off. The setting is kept in the database’s own data, so it stays off through restarts and updates.
cd /opt/netends sudo docker compose exec postgres sh -c 'psql -U "$POSTGRES_USER" -d "$POSTGRES_DB" -c "ALTER SYSTEM SET timescaledb.telemetry_level = off" -c "SELECT pg_reload_conf()"'
If Gia is installed, its model server also contacts its maker, ollama.com, each time it starts. The next release switches that off, along with the database usage report.
When you set it up or use it
- Installing
- The one-paste installer downloads the release from our download server over your private link. For a host with no internet, download the files on another machine and carry them across.
- Update check
- Optional, and set up by hand. Once a day it asks the update feed in its settings for a newer release, sending your license ID and installed version. When it applies an update, it pulls that release’s images from the registry your install uses. Those images aren’t signature-checked; a release bundle applied with the offline updater is. Stop the check with
sudo systemctl disable --now netends-update.timer. - Alert notifications
- Only to the channels you add: email, Slack, Microsoft Teams, SMS or WhatsApp through Twilio, WhatsApp through Meta, or your own webhook. Each message carries the alert’s details, such as the node, its severity and the message. Disable or delete a channel to stop it.
- System email
- Invitations, password resets, sign-in codes, scheduled reports and Gia’s daily digest go through the SMTP server you configure, once you configure one.
- Tickets
- When you connect ServiceNow, Jira or a ticketing webhook, NetEnds opens, comments on, checks and resolves tickets there.
- Sign-in
- SAML, OIDC, LDAP and RADIUS reach the identity provider you configure.
- Name lookups
- Once IPAM holds addresses, it looks up their names on its own, checking each name about once a day, and firewall analysis resolves host names in rules. Both use the DNS servers in Settings → DNS Servers, or the host’s own resolver when none are set.
- Synthetic tests
- Go to the targets you define. A web check against a public site reaches that site.
- Gia’s model
- Runs on your host. NetEnds accepts only a loopback or private-range address for the model server. If you point Gia at a model server on another host on your network, your questions and the data Gia looks up go to that host.
- Gia in Slack
- Idle until you add Slack tokens. Then it opens an outbound connection to Slack, with no inbound port, and your direct messages with Gia pass through Slack. The model stays on your host.
- Gia’s knowledge sources
- When you connect Confluence or SharePoint, Gia reads pages from them.
- The lab
- Building a VM-based emulator image fetches its open-source build scripts from their public repository at a pinned revision, unless you place a copy on the lab host yourself. A build, or a lab node whose image isn’t on the lab host yet, such as a Linux test host, can pull a public image.
Access control
Who can see what, and who can change it.
Every read of network data and every change needs a permission, and a role is a named set of them.
Roles built from permissions
Administrator, Engineer, Operator and Read Only are built in. Build your own roles from view and change permissions for each area of the product.
Scoped to sites and groups
Grant a role everywhere, or only on chosen sites and device groups. A scoped role’s permissions apply only to the nodes inside its scope.
Multi-factor sign-in
Authenticator-app codes, one-time codes by email, and single-use recovery codes. Require MFA for everyone, or for chosen roles.
Your sign-in
SAML and OIDC single sign-on, plus LDAP and RADIUS. Directory groups map to roles, and a user whose groups match no role is refused.
Protection list
Put a node, a site, a device group or a whole environment on it, and config pushes, Autopilot, rollbacks, restores, console sessions and OS upgrades all refuse those nodes. Monitoring carries on.
Audit log
Sign-ins and changes are recorded with who, what, when and from which address, and the log can be exported. Fields named like secrets, such as passwords and tokens, are scrubbed before anything is written.
Signed releases
Every release bundle is checked before it runs.
Checksums and the signature prove different things. The SHA-256 checksums prove integrity: every file arrived exactly as it was packed. The Ed25519 signature proves authenticity: the release came from us. A checksum can’t prove that on its own, because whoever repacks a release can recompute its checksums.
- Your email carries the key. The email with your private link holds the release’s public key, its SHA-256 fingerprint and the checksum of each download. The key reaches you in the email, not with the download.
- The installer checks every download against its checksum before it unpacks anything.
- Then it verifies the signature with that key, before anything is loaded into Docker. A release that fails either check is refused.
- A key inside a release is never used. Once you hold the key, an unsigned release is refused too.
openssl pkeyutl -verify -pubin -inkey ../netends-release.pub -rawin \
-in SHA256SUMS -sigfile SHA256SUMS.sig
sha256sum -c SHA256SUMS Run both from inside the unpacked release directory, with the key from your email saved next to that directory as netends-release.pub. The first command must print Signature Verified Successfully, and every line of the second must end in OK. The key’s fingerprint is in your release email; to confirm it through a second channel, ask us at support@netends.com.
Air-gapped networks
Built for networks with no internet at all.
Installing, licensing and updating all work without an internet connection. You carry the files in; the host checks them.
Offline bundle
Every image, the installer, the checksums, the signature, and a software bill of materials for each image, in files you carry across.
Offline license
Send us the Installation ID shown on the License page, then upload the signed license file you get back. It’s verified on the host, with no license server to reach.
Gia’s model included
Gia’s model ships in its own signed package with the weights already inside, and installs from the files you carried in.
Offline updates
Carry the next release across and run the offline updater. It verifies the release, applies it, checks the platform’s health, and rolls back if the new release doesn’t come up.
The sites map draws from geography data shipped with the product, so it fetches no map tiles. On an air-gapped host, turn off the database usage report too, so it stops trying: the command is above.
Exposure
A short list of open ports.
One host, one short firewall rule set. The database, cache and event store answer only on the host itself: they bind to loopback, so your network can’t reach them.
Check it on your own host: sudo docker compose ps, run in /opt/netends, lists every published port and the address it binds to.
Gia’s model server publishes no port. The lab runner stays stopped until you turn the lab on; while it runs, it listens on port 2222 for the platform’s own use, on loopback and Docker’s internal bridge addresses only.
| Port | Protocol | Used for | Reachable from |
|---|---|---|---|
443 | TCP | Web interface and API, over HTTPS | Your network |
80 | TCP | Redirects to HTTPS, and answers the health check | Your network |
514 | UDP and TCP | Syslog from your nodes | Your network |
162 | UDP | SNMP traps | Your network |
2055 | UDP | NetFlow v5 and v9 | Your network |
4739 | UDP | IPFIX | Your network |
6343 | UDP | sFlow | Your network |
8000 | TCP | The application’s API, for diagnostics on the host | This host only |
5432 | TCP | Database | This host only |
6379 | TCP | Cache and task queue | This host only |
8123, 9000 | TCP | Event store for logs, traps and flows | This host only |
Reporting a vulnerability
Found something? Email us.
Email support@netends.com with “Security” in the subject. The same contact is published for tools at /.well-known/security.txt. We don’t run a bug bounty.
Compliance
Where we stand.
NetEnds has no SOC 2 report, no ISO 27001 certification and no third-party penetration test today. What exists is on this page: signed releases, a software bill of materials for every image, licensing that works offline, and a platform that runs on hardware you control.
Security questionnaires go to sales@netends.com.
Watch it on your own network.
Fourteen days, every tier, on a host you own, with your own firewall watching what it sends.