Nothing calls home.
Start there, and check the rest.
The questions a carrier's procurement and security teams ask are not the ones in a datasheet. They are about dependence: what leaves the building, who can see what, what happens the day the vendor is unreachable, and whether the platform will admit what it cannot see.
Most infrastructure buying decisions are reversed by a single discovery: that the thing you bought needs someone else to keep working.
The short answers
What crosses your boundary
The honest way to answer this is to describe the traffic, not to make a promise about it.
We checked this claim the way you should: by looking for outbound destinations in the software rather than by asserting a policy. There are none. The gateway agent contains no address belonging to us — no update endpoint, no licence server, no metrics sink.
Updates: signed, verifiable, and stoppable
An auto-updating agent on eighty gateways is either a great convenience or the most efficient way ever devised to break a network. The difference is entirely in who can authorise one.
Every release carries a signature
Agent builds are signed with an Ed25519 key, and an agent verifies the signature before it will install anything. An unsigned or tampered build is refused, not warned about.
The key sits on your server
The key that authorises an update to your fleet lives on your own NOC2 host. We cannot sign something your gateways will accept, because we do not hold what they check against.
One switch freezes everything
A single environment variable makes the server offer no update at all to any agent. During a change freeze, an incident, or an audit, the fleet simply stops taking new versions.
The consequence of holding the key is that you must keep it. Losing it does not expose anything, but it does mean the fleet stops accepting updates until a new key is distributed. It belongs in whatever your organisation already uses for keys of that weight — this is a real operational obligation, and we would rather state it than let you discover it.
Who can see what
Access questions in an RFP are usually answered with the word "RBAC" and no further detail. The detail is the answer.
The platform states what it cannot see
This is the section we would most like a security reviewer to read, because it is the one that is usually missing.
Every monitoring system has blind spots: a collector that never ran, a probe deployed to half the estate, a gateway that stopped reporting last Tuesday. The dangerous property is not having them — it is presenting a number computed from a partial sample as though it described everything.
Ask every vendor on your shortlist for this screen. Not the dashboard — the page that says which parts of the dashboard are currently lying. If they cannot show you one, the honest reading is that their coverage gaps are invisible to them too.
Safety functions are never licence-gated
Commercial controls exist. They apply to capabilities, not to the things that tell you the network is on fire.
The failure mode we designed out
A licensing state changes — an expiry, a counter, a mistake in a record — and alerting quietly stops for the affected operators. The network keeps having problems; nobody is told about them.
This is a genuinely dangerous pattern, because the symptom of it is silence, and silence is indistinguishable from health.
The rule
Alerting, incident detection and the operational console are never gated by licence state. A commercial dispute may stop you enabling a new capability. It does not stop you being told a gateway is down.
Enforcement also carries an explicit switch, so the behaviour can be disabled outright rather than reasoned about.
What you are actually buying
| Dimension | Position |
|---|---|
| Deployment | On your infrastructure. Commodity x86 for gateways; the console is your server. |
| Runtime dependency on the vendor | None. No licence call, no activation, no heartbeat. |
| Subscriber data location | Your database, on your host. We hold no copy. |
| Update authority | Signed releases, key on your server, fleet-wide freeze switch. |
| Access control | Four built-in roles plus custom roles; per-operator scoping of which gateways an account can see. |
| Instrumentation honesty | Self-audit page stating broken collectors and coverage as a fraction of the fleet. |
| Hardware lock-in | None. Standard servers and standard NICs; sizing is measured on the hardware you intend to buy. |
The bottom line
A supplier relationship should be a commercial arrangement, not a technical dependency. The test is simple, and you can apply it to every vendor you are evaluating: if they vanished this afternoon, what stops working?
Here the answer is: new capabilities and new software versions. Not forwarding, not authentication, not alerting, not the console, and not your ability to see what your network is doing tonight.
About the screenshots. Every screen shown is a real production console. Gateway hostnames, operator names and site names are replaced with placeholders, and every address is replaced with one from the RFC 5737 documentation range, before the image is taken; no operator, site, region or subscriber identifier appears in any image.