---
title: "How Outpost is hosted"
description: "Where your Outpost runs, how your data is kept apart from other customers, how endpoints connect, and how data is encrypted and backed up."
url: "https://support.outpostplatform.com/get-started/how-outpost-is-hosted/"
product: "platform"
type: "concept"
status: "draft"
ai_summary: "Outpost is a hosted service. Each customer gets an address under outpostplatform.com and a region chosen at signup that cannot change. Each client has its own database, requests cannot reach another client's data, and personal data is encrypted with per-client keys. Agents connect outbound on port 443 with mutual TLS 1.3. Databases are backed up to two separate locations."
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/get-started/how-outpost-is-hosted.md"
license: "CC BY 4.0"
---

# How Outpost is hosted

Outpost is a hosted service. Outpost runs the servers, databases, and storage
behind your console, keeps them up to date, and backs them up. This page
explains where your Outpost runs, how its data is kept apart from every other
customer's, and how your endpoints connect to it, so that you can answer the
questions your own security review will ask.

## Your Outpost

When you sign up, you choose two things that cannot be changed later:

- **Your address.** A name you choose under `outpostplatform.com`. The signup
  page shows the full address before you confirm it. Your team signs in to the
  console there, and it is the address your endpoints report to.
- **Your region.** Where your Outpost and its data are hosted. When more than
  one region is open for signup, the signup page asks you to choose one.

Outpost updates the service for you. There is nothing to install or upgrade on
your side except the agent, and the agent updates itself.

## How your data is kept apart

Every client has its own database. A client's endpoints, inventory, scripts,
tickets, and audit log are stored in that client's database, not in a table
shared with other customers.

On the MSP plan, each organization you manage is a separate client with its
own database. The data your practice owns across clients, such as your team,
sales, and client invoices, is kept in a separate database for your practice.

Your Outpost address decides which client a request belongs to. A request that
arrives for one client cannot name another client, whatever permissions the
person making it holds. Permissions decide what someone can do inside their
own organization, and never let them reach a different one.

## How endpoints connect

The agent on each endpoint opens the connection to your Outpost. It connects
outbound on TCP port 443, so you do not open inbound ports on endpoints or
firewalls for management.

- The connection uses mutual TLS 1.3. Your Outpost proves its identity to the
  agent, and the agent proves its identity to your Outpost.
- Each endpoint receives its own certificate when it enrolls. The agent renews
  the certificate automatically before it expires.
- An endpoint that is retired, or whose certificate is revoked, is refused on
  every request.

Remote desktop sessions use their own connections, described in
[Remote access](/remote-access/).

## Encryption

- **In transit.** The console is served over HTTPS, and agents connect over
  mutual TLS 1.3.
- **Personal data.** Personal data fields in a client's database, such as
  names and email addresses, are encrypted with AES-256-GCM using a key that
  belongs to that client alone. Data copied out of one client's database cannot
  be read with another client's key.
- **Files.** Remote session recordings and ticket attachments are encrypted
  with AES-256-GCM, each with its own key, and those keys are protected by a
  key that belongs to the client.

## Backups of the service

Outpost backs up its production databases continuously, encrypted, to two
separate storage providers, and rehearses a full restore every month. These backups exist to
recover the service. They are separate from the endpoint backups you configure
in [Backup](/backup/).

## Limits

- Your address and region cannot be changed after signup.
- Outpost does not claim certification against a compliance framework on your
  behalf. [Compliance](/compliance/) explains how Outpost helps you measure
  your endpoints against one.
- If you need Outpost on your own infrastructure, or on a network with no
  internet access, see
  [Self-hosted and air-gapped deployments](/get-started/self-hosted-and-air-gapped/).

## Related

- [Concepts and vocabulary](/get-started/concepts/)
- [Supported platforms](/get-started/platform-support/)
- [Security](/security/)