What we do, and do not do, with your sites
This is the page for the person who has to approve Relayant. It describes what the box can and cannot do, what we keep, and what happens when something fails, as the product works today.
The box
The box connects out, and reaches only what you chose
A box at a site is the first thing a reviewer asks about. Here is what it does, and what it cannot do.
- It connects out only
- The box connects out to Relayant over an encrypted WireGuard tunnel. Nothing is opened or forwarded on the site's router.
- It needs nothing from the router
- The box plugs into a LAN port and takes an address by DHCP. It needs only outbound internet, so it works on fibre, DSL, 4G, 5G and Starlink.
- The relay reaches only the pairs you chose
- In the portal you choose which devices and which ports. The relay reaches only those device-and-port pairs, not the site's whole network.
- Only your allowed addresses get in
- A device's address answers only the internet addresses you list. You can choose to allow any address, and the portal warns you what that means.
- It holds no device logins
- We hold no device logins and do not sign in to a device. The one exception is the read-only SNMP, Modbus or BACnet settings you choose for a protocol check. We store them encrypted, do not log them, and use them only to read.
- Checks are gentle
- Health checks send one probe at a time per device and make no login attempt. RTSP checks use OPTIONS only, so they use no recorder stream slot. Discovery does not try the SNMP community "public", because that would be guessing a login.
- It does not watch video
- Video content, picture quality and recording are not checked. That needs the device's login, which we do not hold.
- It belongs to its buyer
- A box belongs to the organisation that bought it. The code on its label is its serial number and is not a secret. Another organisation's box is refused, without saying whose it is, and the owner is emailed. A box reported lost is refused everywhere.
- Its code connects once
- Each box has its own setup code. When it first connects, the box sends a fingerprint of its hardware. A different box presenting the same code is refused, and the owner is emailed. A replacement box is accepted after Re-pair in the portal.
- Updates are signed and roll back
- We sign updates offline, and the box verifies them before they install. They roll out in stages. A box that cannot reach us after an update rolls back by itself.
- OpenWrt and WireGuard underneath
- The box's software is built on OpenWrt, and every tunnel is WireGuard.
- The software agent follows the same rules
- On hardware the site already has, the software agent connects out, finds and reaches devices the same way, and its setup code connects once. It does not own or change the network it runs on.
Your data
We keep little, and we do not store your video
What passes through without being kept, what we hold, and how it is protected. The Privacy Policy has the full detail.
- Video is relayed, not stored
- The box relays video encrypted. We do not store, transcode or inspect it. We count bytes, nothing more.
- Local relays keep camera traffic on your network
- With local relays, camera traffic goes from the site straight to your own control room and does not pass through our servers. A relay can offer cameras on the PC only, on your office network, or anywhere. Beyond the PC, only your office network and your allowed addresses get in.
- Stored secrets are encrypted
- Stored secrets, such as tunnel keys, SNMP communities and DC-09 keys, are encrypted with AES-256-GCM. Passwords are hashed with Argon2id. Backups are encrypted.
- Connections to us are encrypted in transit
- The portal and the API are served only over HTTPS. Every connection between a site and us, and between us and your local relays, is encrypted with WireGuard. Between the cloud relay and your monitoring software, a device is reached by its own protocol, which may not be encrypted. Only your allowed addresses can connect.
- No analytics
- Neither the portal nor this website uses analytics, third-party scripts or external fonts.
What we keep, and for how long
The Privacy Policy lists the records we keep and for how long. The Terms of Service describe what happens when an account ends.
Accounts
Two-factor sign‑in, three roles, and a record of changes
Who can sign in, what each person can do, and how it is recorded.
- Two-factor sign-in
- Owners must enrol an authenticator app before their account can do anything. “Remember this device” skips the code for 30 days on that browser.
- Three roles
- Owners, operators and viewers. Viewers can read and change nothing.
- Invitations
- Owners invite people by email. The link works once and lands the person in the organisation and role on the invitation.
- The audit log
- Changes are recorded: who, what, when, for every site. Failed sign-ins and switched-off protections are highlighted.
- Sessions and sign-in limits
- Sign-in sessions last at most 12 hours. Sign-in attempts are limited, and an account locks after repeated failures.
- No self-service reset of two-factor sign-in
- There is none, by design. Resetting it is a support request with identity checks.
- Our own staff
- Our platform administrators need two-factor sign-in, and support actions they take in your account are recorded under their own name.
- Your organisation only
- Your organisation sees only its own sites, devices, people and history.
Alarm signalling
Alarm signals are supplementary, and we say so
Alarm signals go into your monitoring software over SIA DC-09, in SIA or Contact ID format, with the reason in the alarm text. A restore follows when the fault clears.
The statement
Our alarm signals are supplementary fault signals. They tell your control room that a device has stopped answering, has a fault, or that a site’s network is down. They do not replace the alarm panel’s own communicator.
DC-09 signalling supports AES encryption, a backup receiver and link supervision. The check message is every minute, every 90 seconds, every 5 minutes or every hour, chosen in the portal. You choose, per device, whether its faults go to email, to your monitoring software, or both.
The detail is on Alerts and alarm signals and in the guide Alarm signals into your monitoring software.
If we are unreachable
The box keeps trying, and local relays carry on without us
Here is what keeps working without us today, and what does not.
- The box keeps trying
- The box is connected whenever internet, power and our service are all available. Otherwise it keeps trying, unattended. It does not need a person on site.
- Local relays keep working
- Today, local relays carry on for sites that already reach them while we are unreachable.
- The cloud relay depends on our service
- Connections through the cloud relay pass through our service and depend on it. Connections through your own local relays do not.
- Alerts and alarm signals depend on our service
- Our service raises alerts and alarm signals, not the site. While a site cannot reach us, its box is reported offline. On the Relay + Alerts plan that alert is sent and its alarm signal raised. Nothing else is raised for that site's devices until it is back. If our service itself is unreachable, no alert or alarm signal is raised. Our signalling runs alongside the alarm panel's own communicator.
- If the site loses internet or power
- The box reconnects by itself when internet and power are back. Meanwhile the portal shows the site offline and, on Relay + Alerts, an alert is raised.
- If one of your local relays is down
- Every box keeps a connection to every enabled local relay at once, and each camera has the same port on every relay. When one relay is down, your monitoring software can use another without a change.
Reporting a vulnerability
Email us the details of a security problem
If you find a security problem in the portal, the box, the software agent, a local relay or this website, email us.
Write to [email protected] with “Security report” in the subject. Say what you found, how to reproduce it, and how to reach you. We reply by email.
The same contact is published at /.well-known/security.txt.
Parts built to stay connected
Several parts are built to stay connected
The box does not need a person on site, several local relays can be connected at once, and updates roll back. Today, local relays carry on for sites that already reach them while we are unreachable.
Ask us anything this page does not answer, or send it to the person who has to approve the product.