Security Overview
Enrollment trust
Zero-Touch tickets can be used only once and expire after a limited time. The raw ticket value is not stored as a Server secret that can be displayed again.
Agent identity
Managed Host identity is based on enrolled Agent/machine identity, not merely hostname, display label, or observed source IP.
Policy semantics
WHITELIST denies unmatched requests. BLACKLIST is supported only by Remote Access: matching enabled Rules deny, unmatched requests allow. Rules have no ordering or per-rule action. Policy reset removes Mode/Rules and returns each plane to its own initial state. AI authentication remains required independently.
Internet Access safety
Internet Access must not become an open proxy. Destination validation, protocol/port validation, safe DNS resolution, rebinding resistance, SSRF protection, and audit are part of the security boundary.
AI authentication
An AI display name is not authentication. Supported integrations use verified OAuth or another explicitly supported credential path. Authentication remains mandatory even when AI Access policy enforcement is disabled.
Secret handling
Configuration export, support bundles, logs, and AI copy/paste workflows must redact enrollment tickets, OAuth or bearer secrets, private keys, and equivalent protected values.
External boundary
DataRelay Link does not weaken target OS authentication, application credentials, TLS certificates, cloud firewalls, or external NAT/DNS controls.Last modified on October 28, 2026
