Skip to content

Home / Security

Security, built in from the first line.

Azimuth reaches into your customers' networks, so it is built to need as little access as possible, and to log every use of the access it has.

At a glance.

The short version, before the detail.

Two-step sign-in for everyone
No open ports at your sites
Every remote action logged
Data in the EU
Staff access only through logged support sessions
Card numbers never reach Azimuth

The detail.

Sign-in

Two-step sign-in with an authenticator app is mandatory for every user, with single-use recovery codes.
Too many wrong passwords lock the account for a while; repeated attempts from one address are slowed down.
Sessions expire on their own, and every sign-in and failed sign-in is recorded.

Connections

Agents and site tunnels connect outbound from the site. Nothing at a customer site has to accept incoming connections.
Site tunnels are WireGuard. Customer networks keep their addresses through 1:1 mapping.
A tunnel's gateway settings are shown to admins only, and every view is logged.

Remote actions

Reboots, updates, scripts and remote desktop sessions are confirmed and logged with who, what and when.
Scripts run only from the company's library after an admin approves them; editing a script needs approval again.
Remote desktop runs on Azimuth's own server, not a third-party cloud, and every session is listed.

Azimuth's own access

Azimuth staff see a company's data only by opening a support session with a stated reason.
Support sessions last 15 minutes to 2 hours, show a banner to the company, and every action is logged under both names.
Everything platform staff do is kept in a separate platform audit log.

Your data

Hosted at Hetzner in Germany, in the EU.
Every record is tagged with its company, and the data layer enforces that tag on every query.
Controller passwords, API keys and authenticator secrets are stored encrypted.
The database is backed up every night.
Card payments are handled by Stripe; card numbers never reach Azimuth.

The agent itself

Enrolment codes are tied to one site, with a use limit and an expiry date.
Updates are checked against a SHA-256 hash before they install.
If a new version fails to report, the agent rolls back to the previous one on its own.

Who can do what.

Every person in your company has one role. Pick a role to see what it allows.

Technician can

See the Overview, globe and alerts
Acknowledge and snooze alerts
Open and work tickets
Run remote actions and approved scripts
Open remote desktop sessions
Add equipment, sites and websites
Approve scripts
See tunnel gateway settings
Connect controllers and manage integrations
Set alert rules and wall-screen links
Manage the subscription, card and invoices
Invite technicians and viewers
Add or change admins and owners

Questions about security?

Ask us anything, or ask for our data processing agreement.

Contact us Privacy policy