Design philosophy

Your data stays yours

What your machines report, their history, their settings and what you do on them is sealed on your own devices, with keys only your consoles hold. The Dispatcher, the server your devices meet through, passes on and stores what it cannot read. A breach of our servers, or a demand made to us, cannot hand over what we never had. What our server does see, such as your sign-in email and when your devices are online, is listed in full; the names you give your account, sites, groups and people are sealed too. How this works.

Shown, not just claimed

We state a security property on this site only when the mechanism is in the product, a test checks it, and you have a way to check it yourself. Where something is not done yet, we say so on the same page. The checks you can run.

Secure by default

When security and convenience pull apart, security is the default; the convenient option is a choice someone makes, visible to the people it affects and written into the audit log. Terminals, forwards, SSH from the account, accounts per person on machines, and restarts and packet capture through the root executor all start switched off. Joining an account means accepting management by its owners and admins: they switch a power on from their consoles, only for the consoles they list, and a second console confirms. Every session is checked on the machine, recorded and shown to the person there. What is on and off.

Every access leaves a trace

Every change to the account is an entry in its signed log, and every session, view and root action is recorded and signed by the machine it happened on. Terminal sessions are recorded too, sealed for owners, admins and auditors, and the person at the machine is told. You can export it all and check it without us, with a script in plain Python that is not ours to trust and applies the same rules as the app. Verify an audit export.

No authority above your account

Each device makes its own keys. Trust comes from your account's signed log, which starts at the owner's first console, not from a certificate authority and not from us. A new console joins only after a person compares three words on both screens and a second console confirms; a machine only after root on it agrees and an owner or admin approves it. Two witnesses countersign each state of the log, so our server cannot show your devices a different one. Accounts and roles.

Only the rights each part needs

Nothing that talks to the network runs as root. Root work is split into a helper that only reads and a root executor that acts only on signed requests it checks against its own copy of the log. People get roles that reach only the customers, sites and groups they work on.

Written down, kept small

What leaves each machine, to whom and encrypted how, is described in plain words, and so is what our server can see. This website has no cookies, trackers or analytics. What runs where.

Built to be hard to break

MoxiVue is written in Rust, a language that rules out whole classes of memory errors attackers use against software written in C and C++. Every release is built twice, on two fresh machines, and published only when both builds are the same, byte for byte. TLS 1.2 is not even built into our programs. The design of accounts, keys and witnesses was checked with formal tools before it was built; what that does and does not show.