Security at Outpost
Outpost manages the computers your organization runs on, so how it protects your data, and who can make it act, is the first question a security review asks. This page summarizes the protections Outpost has, with links to the pages that describe each one in detail. It is for IT managers and MSP owners answering a security questionnaire, and for the technicians who have to support those answers.
How your data is kept apart
Section titled “How your data is kept apart”Every client has its own database. A client’s endpoints, inventory, scripts, tickets, and audit log are stored there, not in tables shared with other customers. On the MSP plan, each organization you manage is a separate client, and the records your practice owns across clients are kept in a separate database of their own.
Your Outpost address decides which client a request belongs to. A request made for one client cannot name another, whatever permissions the person making it holds. See How Outpost is hosted.
How endpoints connect
Section titled “How endpoints connect”The agent opens every connection, outbound on TCP port 443, so you open no inbound ports for management. The connection uses mutual TLS 1.3: your Outpost proves its identity to the agent, and the agent proves its identity to your Outpost with a certificate of its own, issued when it enrolls and renewed automatically. An endpoint that is retired, or whose certificate is revoked, is refused on every request. An expired certificate is accepted only for a grace period you control, so an endpoint that was turned off for months can reconnect. See Bring endpoints back from storage. See The Outpost agent.
Encryption
Section titled “Encryption”| What | How it is protected |
|---|---|
| Traffic to the console | HTTPS. |
| Traffic between agents and your Outpost | Mutual TLS 1.3. |
| Personal data in a client’s database, such as names and email addresses | AES-256-GCM, with a key that belongs to that client alone. |
| Stored credentials and other sensitive fields | AES-256-GCM, with each value bound to its table and column. |
| Remote session recordings and ticket attachments | AES-256-GCM, each with its own key, protected by a key that belongs to the client. |
| Endpoint backups | Encrypted on the endpoint before they leave it, with a key the endpoint generates. |
The Depot server and the agent run their cryptography in FIPS 140-3 mode by default, on every agent platform except OpenBSD. See FIPS 140-3 mode.
What Outpost can and cannot read
Section titled “What Outpost can and cannot read”Some data is protected so that Outpost itself cannot read it.
- Clipboard and file transfers in remote sessions are end-to-end encrypted between the technician’s browser and the endpoint. Your Outpost relays ciphertext and holds no key. Screen video and keyboard and mouse input are encrypted in transit on each leg, but your Outpost can read them, because it forwards them and records the video when recording is on. See Remote access.
- Backups in zero-knowledge mode. By default, Outpost keeps a sealed copy of each backup key, so it can help you restore after you lose an endpoint. In zero-knowledge mode it keeps none, and only the endpoint and the recovery kits you download can open the backups. See Backup encryption keys and recovery kits.
Who can do what
Section titled “Who can do what”Every action in the console is allowed or refused by a permission, checked by the server on every request. Each person holds one or more roles, and a role is a set of permissions. See Roles and permissions and the full Permissions list.
Console accounts are protected by a password and, once the person turns it on, two-factor authentication. Access rules can limit sign-in to listed networks and hours. See Manage your console account and Restrict console sign-in with access rules.
What is recorded
Section titled “What is recorded”- Audit logs. The console keeps two hash-chained records: what people did in the console, and what endpoints changed on themselves. Each entry carries a hash of the one before it, so an edit made outside the console is detected. Nobody can edit or delete an entry from the console. See Audit logs.
- Security notices. When something changes on a console account, such as a sign-in from a new device or a password change, Outpost emails the person whose account it is, and texts them for the most serious changes. These notices cannot be turned off. See Security notices and SMS.
Backups of the service
Section titled “Backups of the service”Outpost backs up its production databases continuously, encrypted, to two separate storage providers, and rehearses a full restore every month. These backups exist to recover the service. They are separate from the endpoint backups you configure in Outpost Backup.
What Outpost does not claim
Section titled “What Outpost does not claim”Outpost does not claim certification against any security or compliance framework on your behalf. Compliance explains how Outpost helps you measure your own endpoints against one.
Report a vulnerability
Section titled “Report a vulnerability”If you find a security problem in Outpost, report it privately. See Report a vulnerability.
Related
Section titled “Related”Content is licensed CC BY 4.0. Code samples are MIT. Outpost and the Outpost mark are trademarks of Outpost Business Solutions, PBC and are not covered by either license.