Security & architecture
You can hand us your network and keep the keys.
Witina AI reads your topology and pushes configuration to live gear. This page explains, in technical detail, how it's built and where your secrets live.
The shape of the system
Two pieces. A lightweight gateway runs inside your network and does all the privileged, local work: discovery, polling, holding credentials, applying changes. The cloud is the brain: topology, alerting, change management, reporting. Sensitive access never has to leave home, and the gateway only ever dials out.
No inbound ports. You never expose a management plane to the internet. The gateway makes an outbound connection, and everything between it and our cloud rides over that.
Credentials
Your secrets stay on your side
This is the part most tools get wrong: they collect your device passwords into their cloud and ask you to trust their vault. We don't have that vault. When you add a credential in the console, it's passed through to your gateway over TLS and stored, encrypted, only there. We don't store your device passwords in our cloud, so there's nothing there to leak, subpoena, or breach.
In the cloud
We don't store your device passwords here.
In transit
Relayed to your gateway over TLS, held in memory, then written only to the gateway, encrypted.
At rest
On a gateway you run, on infrastructure you own. Self-host and even the transit stays on your LAN.
Encryption at rest
Encrypted on the gateway, with keys you control
Credential material on the gateway is encrypted at rest. If you've used LUKS or FileVault, the model will feel familiar. One key encrypts the data, and that key is never stored in the clear. It's wrapped in a keyslot, and you choose what holds the key that unwraps it:
TPM-sealed
The key is sealed to a TPM 2.0 chip and never touches disk. A copied disk image or backup is useless without the physical hardware.
SaaS-assisted
The key is split between the gateway and the cloud, so neither a stolen gateway nor a breach of our cloud can decrypt on its own. You need both halves.
Local key file
A key file on the gateway, for fully offline and self-hosted deployments that never depend on anything outside your own hardware.
You set the policy per gateway (require TPM, SaaS-assisted, or local file) and the gateway reconciles its key storage to match. And because the SaaS-assisted mode needs the cloud's share to unlock, de-authorizing a gateway is a crypto-shred: withhold the share and the data on a lost or decommissioned device is cryptographically unrecoverable, whether or not the box is ever recovered.
The gateway
Least privilege
It isn't root
The gateway runs as an unprivileged user with a handful of narrow Linux capabilities: enough to sniff packets for discovery, serve firmware on one port and carry the VPN's tunnels, nothing more. Reboots and image upgrades go through a separate, API-mediated path. A compromise of the gateway process is not a root shell on your router.
It only dials out
The gateway opens an outbound connection to the platform and proves its identity with a signed token; it's provisioned once with a pairing token and renews itself after. You open no inbound ports and publish nothing to the internet. The VPN keeps it that way: the gateway sends first, toward each technician, and the tunnel comes back through the opening that makes in its own NAT.
Scoped credentials
You decide which credentials are allowed to touch which devices, and you can audit that mapping.
Runs where you want
Appliance, VM, or container, including a fully self-hosted single container. Credentials are handled the same way in every option.
Discovery
Quiet by default
Bringing a network online shouldn't set off your own alarms. Discovery starts passive. It listens to what devices already announce on the wire (DHCP, LLDP/CDP, mDNS) instead of scanning. Active probing and auto-connect are opt-in decisions you make per network, so onboarding doesn't light up your IDS or hammer gear that isn't yours to touch.
Change management
Nothing changes without a paper trail
Configuration changes don't happen as anonymous, irreversible edits. Each one can be routed through approvals, snapshots the device's current state before it touches anything, verifies the result, and can be rolled back to the snapshot if it misbehaves. A complete audit log records who did what, when, and why.
Remote sessions leave a trail too. Opening a terminal or a device's web interface is its own permission, checked against the scope you're acting in. The gateway logs in with the stored credential, so the password never reaches your browser. Terminal sessions are recorded from what the device sends back, which keeps a password typed at a hidden prompt out of the recording, and opening and closing one is logged.
Tenancy & access
Isolation and identity
Multi-tenant isolation
An Organization / Division / Region hierarchy scopes every record, so an MSP can manage many customers from one console without their data mixing. Access is checked per request against the scope you're acting in.
Bring your own identity
Sign in with your own identity provider over standard OIDC / OAuth (Authorization Code + PKCE), configured globally or per organization, so account lifecycle stays where your IT already manages it.
Technician VPN
A VPN that starts closed
The Witina VPN puts a technician's computer on a site's network through that site's gateway. Nobody connects until a policy names their team. Roles decide who can see and change the policies; no role lets anyone in by itself.
Enforced at the gateway
Each session gets its own allow set on the gateway: the site's networks and an end time. The gateway drops everything else, and it holds the end time itself, so a session that loses touch with our cloud still closes on schedule.
Your traffic stays off our cloud
Our cloud decides who may connect and introduces the two ends. The tunnel runs directly from the technician's computer to the gateway over WireGuard. The computer makes its own key, and the key never leaves it. VPN traffic isn't recorded.
A record of every connection
Each connection through the tunnel is kept as a flow record, for 90 days unless you change it: when, where to, how much, and the gateway's port as the site logged it. Sessions, policy changes and turning the VPN on or off at a site go in the activity log.
A link only your own app should open
The app joins an account through a link it opens in the browser. If the browser's address or operating system doesn't match the app's, Witina shows a warning, and no site turns on until the person confirms it's their own app.
Start with your own network
Deploy a gateway and add a credential, and it's stored encrypted on that gateway from the first minute. The cloud is free for up to 10 devices, with no credit card.