Security by design
A tool that can act on all your devices must be the hardest one to hijack. Here is every measure EPM takes, and what it prevents in practice.
01Chain of trust
From your security key to execution on the device, every step is checked. If a single one fails, nothing runs.
For a risky action, the console asks for your key.
WebAuthnIt carries a signature and an expiry date.
Ed25519The agent connects to the server, never the reverse.
outbound · 8443Encrypted and recognised on both ends.
TLS 1.3 · mTLSSignature and expiry, before acting. Otherwise it refuses.
device key in TPMLive result, written to the audit log.
audit log02Measures
Every order sent to a device is signed and carries an expiry date. The agent checks the signature before acting and refuses everything else.
What it prevents: A forged order, or an old order replayed, is refused by the device.
Ed25519 signature, per-order expiryRisky actions require your key: installing a patch, updating an agent, rebooting a server, changing a policy.
What it prevents: A stolen password is not enough to act on your fleet.
YubiKey / WebAuthnThe key that identifies the device is stored in the TPM 2.0 chip and cannot leave it.
What it prevents: A machine can be neither cloned nor impersonated.
TPM 2.0, non-exportable keyEach agent and the server authenticate each other. The agent pins the server's authority.
What it prevents: Nobody can put themselves between your devices and the server.
TLS 1.3, mutual authentication (mTLS)The agent always calls the server, never the other way round.
What it prevents: Nothing to scan or attack on your devices from the network.
Outbound connection onlyThe console is reachable only from the networks you authorise.
What it prevents: No login page visible from the outside.
Access limited to authorised networksPassword plus security key, TOTP code as a fallback, single sign-on (SSO).
What it prevents: A phished credential is not enough to get into the console.
WebAuthn, TOTP, Keycloak SSODeployed applications carry the owner's code signature. The Windows agent is Authenticode-signed and refuses any unsigned update.
What it prevents: A tampered package or a trojanised agent is never installed.
Code signing, Authenticode (Microsoft Azure Artifact Signing)In the application catalogue, an administrator cannot approve their own package.
What it prevents: No single person can push software to the whole fleet alone.
Draft, pending, published workflowThe agent refuses to stop vital Windows services and processes, and to disable itself.
What it prevents: Even if the console were compromised, your devices stay up and monitored.
Enforced by the agentRun-as account passwords are encrypted, sent encrypted for the target device only and never written to its disk.
What it prevents: A secret can be read only by the device that needs it, when it needs it.
AES-256-GCMWho, what, when, on which machine, with what result.
What it prevents: You answer an audit or an incident with facts, not guesses.
Timestamped log03Your data
EPM is not an online service: it is software you host yourself.
EPM is installed on your server (Docker), inside your network. No data about your fleet goes to a third-party cloud.
An asset for your GDPR, NIS2 and DORA requirements: you know where your data is, and who accesses it.
Automatic backups every night and a documented restore procedure.
Your CISO wants to understand the signing chain, key handling or traceability? We take the time to answer.