Security

Your network and your subscribers’ data, behind eight layers.

Every layer was designed to fail closed: if something doesn’t add up, the system answers “I see nothing”, never “I see everything”. Here’s how each one works, and what we don’t do yet.

Layer 1 of 8 · Browser

The panel doesn’t even trust its own page.

Content Security Policy with a fresh nonce on every request: only the panel’s own code runs.
Clickjacking protection: the panel can’t be embedded in another site.
The session lives in an HttpOnly cookie; no token is kept in localStorage.
Text coming from OLTs is sanitized before it’s displayed.

Layer 1 of 8 · Browser

The panel doesn’t even trust its own page.

Content Security Policy with a fresh nonce on every request: only the panel’s own code runs.
Clickjacking protection: the panel can’t be embedded in another site.
The session lives in an HttpOnly cookie; no token is kept in localStorage.
Text coming from OLTs is sanitized before it’s displayed.

Layer 2 of 8 · Sign-in

Getting in is hard; guessing is harder.

Passwords stored with bcrypt (cost 12); never in plain text.
Attempt limits: 20 per IP and 6 per account every 15 minutes, with the same response in both cases.
Two-factor authentication with TOTP (each code works only once) and 10 backup codes.
Passkeys, which resist phishing because they check the site.
Platform accounts can’t operate without a second factor.

Layer 3 of 8 · Session

A stolen session gives itself away.

Access token valid for 15 minutes, kept in memory only.
Rotating refresh token: each one works for a single renewal.
If an already-used token shows up again, all of the user’s sessions are closed and it’s logged in the audit trail.
Without “keep me signed in”, the session expires after 12 hours of inactivity.

Layer 4 of 8 · Permissions

Hiding a button isn’t security.

Three roles per operator (Administrator, Support and Installer), enforced on the server.
All 141 API routes were reviewed per role: no secret reaches support or installers.
A test checks the menu against the server’s real permissions.
The platform account is separate and checked against the database, not the token.

Layer 5 of 8 · Isolation

Each ISP sees only its own data, and the database enforces it.

PostgreSQL Row-Level Security on every table holding operator data.
If a query has no operator, the result is an error or zero rows: it fails closed.
The server refuses to start if its database user could bypass isolation.
66 automated isolation tests; asking for someone else’s resource returns 404.

Layer 6 of 8 · Secrets

Your OLT passwords never come back to the screen.

SSH and SNMP credentials encrypted with AES-256-GCM.
The browser never receives those credentials, not even encrypted.
Webhook secrets are stored encrypted too.
The VPN private key is shown once and never stored.

Layer 7 of 8 · Network & devices

Talking to your OLTs without opening doors.

Values sent to an OLT’s CLI are validated: they can’t carry control characters.
The CLI explorer is read-only, with an allowlist of commands per vendor, and every attempt is audited.
Webhooks only go to public destinations: internal networks and cloud metadata are blocked.
The WireGuard VPN to your MikroTik only accepts private networks, with no overlap between operators.

Layer 8 of 8 · Operations

Everything is logged, and nothing installs itself.

Audit trail of sensitive actions and sign-ins, exportable to CSV or TXT; the export itself is logged.
Every update arrives signed (Ed25519), is applied when a person decides, and can roll back to the previous version.
Database backup before every update, and encrypted server backups with rotation.
Webhooks sent by the panel are signed with HMAC-SHA256.

Try it

What happens if operator A tries to see operator B’s data?

Pick an attempt. These are the same cases the panel’s automated tests cover.

Request · operador A

GET /api/onus/8812   (ONU 8812 belongs to operator B)

Response404 Not found

For operator A that ONU doesn’t exist: it doesn’t even confirm it exists.

Sessions

What happens if someone copies your session.

The refresh token changes on every use. If an old copy shows up again, the system assumes theft and closes everything.

Your browser

Someone with an old copy

#1valid

Log

Sign-in · token #1 is issued

Roles

Everyone sees what their job needs.

AdministratorEverything within the operator: users, OLTs and their credentials, audit trail, backups and the CLI and SNMP explorers.
SupportDay-to-day operations and diagnosis. Never sees credentials.
InstallerOnly what’s needed in the field to install and measure; their write permissions are pinned by a test.
Platform (eCloud)A separate account, with mandatory two-factor authentication, checked against the database on every request.

Privacy

Few third parties, and we tell you which ones.

A single cookie: A technical one, for the session. No analytics, no advertising.
No CDN or external fonts: Typefaces and the panel’s code are served from its own server.
Maps: Base map tiles come from Esri, which sees the viewer’s IP and the area being viewed.
Payments: Subscription payments go through Stripe or PayPal; their notifications are signature-checked and processed only once.
Recorded acceptance: Terms, privacy and cookies are accepted at sign-in, with version, date and IP, in a record that can’t be edited.

Transparency

What we don’t do yet.

We’d rather you hear it from us.

We have no certifications (SOC 2, ISO 27001) and no external penetration test.
There’s no single sign-on (SSO, SAML or OIDC).
Two-factor authentication is mandatory for platform accounts; for each ISP’s users it’s optional.
The attempt limit is a 15-minute window, not a progressive lockout; if its service (Redis) goes down, it stops applying in the meantime.
With “keep me signed in” checked, the session renews with no absolute cap.
Telnet is available for older OLTs and isn’t encrypted; it isn’t the default and the form warns about it.
Passkeys haven’t been tested on Safari yet.

Fewer trucks on the street. More subscribers who stay.

We’ll walk you through eCloud OLT Controller with your own OLTs, in 30 minutes.

Watch the prediction again