No inbound agent ports
Control agents initiate their own authenticated WebSocket connection to the Hub.
Security model
Useful power needs visible boundaries.
42 O’Clock products are designed around outbound connectivity, least privilege, explicit approvals, and evidence operators can inspect.
Secrets stay local
Vault keys, registry credentials, and infrastructure credentials remain on the edge system where they are used.
Actions leave evidence
Remote commands have durable state, actor attribution, bounded results, and optional approval requirements.
Control is not a hidden shell
Emergency diagnostics are disabled by default, time-limited, TOTP-gated, and restricted to fixed read-only commands. Interactive terminal work belongs in TermHop’s separate security boundary.
TermHop encrypts at the endpoints
Terminal plaintext and durable device credentials are encrypted between the browser and agent. The relay still sees routing metadata, IP addresses, timing, identifiers, message types, sizes, and ciphertext, and it can delay or deny service.
Recovery without hub decryption
Infrastructure Vault encrypts selected configuration files on the agent with AES-256-GCM. The Hub stores ciphertext and integrity metadata, while restoration happens offline with the operator-held key.
Tenant and client isolation
Owner, administrator, and viewer roles govern access. Viewer credentials can be scoped to one client group, and cross-scope identifiers fail closed.
Responsible reporting
Do not include credentials, private customer data, or live exploit details in a public issue. Contact the project privately before disclosure.
Next step
Inspect the implementation.
Control is open-core, so operators can review the agent, Hub, migrations, and deployment definitions directly.