Security
Designed so your customers' networks stay closed
Monitaria does the monitoring on-premises and only sends a small status snapshot out. Here is exactly how that works.
Outbound-only architecture
The collector VM at each site initiates every connection to the hub. The hub never connects back in, so there are no inbound firewall rules, port forwards or VPNs to set up or maintain.
Customer site (on-premises)
Step 1
Your devices
Routers, switches, access points, firewalls, servers, printers and web services on the local network.Step 2
Collector VM
Polls each device, keeps history in local SQLite, raises alerts and serves its own dashboard. Works fully standalone.
Hosted
Step 3
Monitaria Hub
Every site's status in one dashboard for the MSP. Sign in with Microsoft or Google. Sites that stop reporting are flagged as stale.
The hub never connects in to the site. No inbound firewall ports, no VPN, no port forwarding.
No cloud dependency
The collector works fully standalone. Monitoring, history, alerts and the local dashboard all keep working with no hub connected, or when the site's internet link is down.
Stale-site detection
If a collector stops reporting, the hub flags that site as stale, so silence is never mistaken for “all OK”.
What data leaves the site, and what doesn't
Sent to the hub (status snapshot)
- Sensor name
- Device label
- Status (for example up, warning, down)
- Latest value
- Status message, with any IP addresses redacted before sending
Never leaves the collector
- Device IP addresses
- Hostnames
- URLs being monitored
- SNMP community strings
- Measurement history
Request signing and transport
TLS in transit
Every push from a collector to the hub travels over HTTPS.
HMAC-SHA256 signatures
Each request is signed with HMAC-SHA256 using a secret shared between the collector and the hub, so the hub can verify which collector sent it and that it wasn't altered.
Replay protection
Signed requests carry a timestamp and a nonce. Old or repeated requests are rejected.
Access control
Collector VM: local accounts and 2FA
The collector's web dashboard uses local user accounts. Each user signs in with a password and can turn on two-factor authentication. The dashboard is served over HTTPS on the VM.
Hub: single sign-on
The hub uses sign-in with Microsoft or Google work accounts, so access follows your existing identity provider and its policies.
Data retention
Measurement history is stored in SQLite on the collector VM. By default it is kept for 30 days, and the retention period is configurable.
History is never sent to the hub. Only the status snapshot described above leaves the site.
Reporting a security issue
If you believe you've found a security vulnerability in Monitaria, please email support@monitaria.com with “Security report” in the subject line.
See what Monitaria costs for your sites
Tell us how many sites and devices you look after and we'll send you a quote.