Home · Security
Security
If your threat model includes “the vendor VPN’d into our plant,” Dutywall is built to say no. The box works without us. The cloud cannot open a port for us.
The outbound-only seam is the same reason a polling TV works through NAT, and it is the story you can take to a reviewer. We are not selling a FedRAMP badge. We are selling an architecture that degrades to fully offline.
TLS in front of anything that leaves the LAN. Alert-token rotation. Not exposing :8090 to the internet. Backups of the data volume. A real NWS User-Agent. Those are ops, listed in the install guide, not optional because a dashboard was pretty.