Security and your data

The agent

• Outbound only. The agent connects out to SmrtMonitorPro. No inbound ports are opened on your machines, and remote desktop and SSH are tunneled through that same outbound connection.
• Signed updates. Agent updates are cryptographically signed, and an agent refuses any update that isn’t.
• Remote commands are opt-in. Running commands on a machine is switched on per agent. It’s off until you turn it on.
• You choose what it collects. Each collector (metrics, logs, file integrity, inventory and the rest) can be turned on or off per machine or for the whole fleet.

Your data

• Hosted in the United States by BuildITSmrt. Each customer’s data is kept in its own workspace.
• Retention you can see. Logs are kept for the period your plan includes (7 to 365 days) and then deleted.
• Encrypted backups. Endpoint backups are encrypted, and you can choose zero-knowledge encryption so only you hold the key. Backups go to storage you choose, with optional immutable copies.
• If you leave, your workspace stays readable for 30 days so you can export it, then it’s eligible for deletion.

Access to the console

• Two-factor sign-in with recovery codes
• Roles from read-only viewer to admin
• Single sign-on (OIDC) on the Enterprise plan
• An audit log of sign-ins and changes, with a hash chain you can verify for tampering and export to CSV
• Chats with the person at a machine are recorded, and both sides are shown that they are

What’s still in progress

We’d rather tell you than have you find out:

• The Windows installer isn’t code-signed yet, so Windows SmartScreen asks you to confirm it the first time.
• There’s no macOS agent, and none is planned.
• Zero-knowledge backup encryption means no one, including us, can recover a backup if you lose the key.