Security and data
What Hopix collects, where it lives and how it is protected
This page describes how Hopix works today, in plain words. For a security questionnaire or the full data-processing details, contact us.
Architecture
Agents that only talk outward
No inbound ports
Agents connect out over encrypted HTTPS on port 443. Nothing listens on the device, and no firewall rule has to change.
An identity per agent
Each agent gets its own credentials when it enrolls, and they renew on their own. They can be rotated at any time, and an agent can be revoked from the console.
Signed commands
Agents only accept commands signed by the Hopix cloud, and check every signature before they act.
Signed updates
Updates are signed and verified on the device before they install. Agents only move to newer versions, and roll back if a new version does not start.
Access
Isolated tenants, strong sign-in
Isolation on the server
Each customer is a tenant. The server limits every request to one tenant, so isolation does not depend on the interface.
Sign-in
- SAML 2.0 single sign-on per tenant
- Roles from your directory groups through single sign-on
- Passkeys and authenticator apps; MFA enforced per tenant
- Repeated wrong codes pause sign-in by code and warn the user
- Passwords stored only as a strong one-way hash
- Idle sessions expire on their own
- Sensitive actions ask you to confirm it is you
Least privilege and audit
Separate privileges for tenant administration, agent administration and each view. Sign-ins, user changes, agent commands and settings changes go to the audit log, which you can forward to your SIEM over syslog, encrypted by default.
Encryption in transit
Everything between agents, browsers and the cloud travels encrypted with TLS. Sensitive settings, such as webhook addresses and authenticator secrets, are also encrypted inside the application.
Data
Exactly what the agents send
Each agent measures on the device and sends only summaries: per-minute figures and records of connections and drops (IP, port and process). The Windows agent does not capture packets; on macOS and Linux the agent looks at packet headers on the device and never collects their contents. No raw packets or content ever leave the device.
| Data | What is sent |
|---|---|
| Device | Hostname, operating system version, a one-way hash of the machine ID, the IPv4 addresses of its adapters, the names of signed-in users (hidden by default) and the status of the agent’s measurement sources. |
| Connections | Per minute: remote IP and port, protocol, process name (never its path), bytes, round-trip time, retransmissions and failures. |
| DNS | Each domain name looked up (by default, only its main domain, except the internal domains you list), its result, the first address in the answer, the latency and the process that asked. |
| Wi-Fi | Network name (SSID), signal, band and channel; on Windows also the access point ID (BSSID) and the adapter address. By default, network names and access point IDs are replaced by tokens, except the corporate networks you list. The Linux agent has no Wi-Fi module. |
| Protocols | Per minute, for the protocols the device uses or serves: operations, result codes, response times, and the negotiated versions and security. Servers by IP address and name; shares and other server resources only as tokens. Never user names, credentials or contents. |
| Local network | The IPv4 routes and the neighbor table (IP and MAC addresses); by default, only the gateway’s entry of that table. |
| Radar | Only while an administrator runs a session: the targets, each hop, its latency and its reverse DNS name. |
| Resources | CPU, memory, disk and the busiest processes. |
A privacy profile per tenant
A tenant administrator chooses how much detail leaves the devices: recommended (the default), strict or full, for the whole tenant or for one agent. The agent applies it on the device, before anything is sent, and relaxing it requires signing in again.
Never collected
- Keystrokes or screen contents
- Full URLs or web page contents
- File contents
- Raw packets, or the data inside your connections
Where it lives and for how long
- Hosted in the United States
- Telemetry, including the DNS and Wi-Fi history, kept 30 days on Essentials, 90 days on Pro, and 90 days on Enterprise; detailed Wi-Fi signal samples and Radar sessions, 7 days on every plan
- Removing an agent deletes its telemetry
- No analytics, advertising or tracking services in the console or on this site
Third parties
Few parties, all named
Hopix runs on one hosting provider in the United States, named in our subprocessors list, which provides the hosting, DNS and email delivery. Apart from that, the cloud only connects to the destinations you configure: your Teams, Slack and webhook URLs, your SIEM’s syslog servers and your identity provider.
Found a vulnerability? Write to security@valnetworksllc.com.
See Hopix on your own network
Book a 30-minute walkthrough. We install an agent with you and look at real data together.