This page covers the behavior you can see and the principles we follow. It does not go into internal implementation details.
Devices: read-only and controlled
- Read-only commands and limited probes: Topolux runs only read-only commands and limited connectivity probes (ping and tracert), and currently never changes device configuration.
- Verified before it runs: the platform verifies which devices each task may reach, which commands it may run and where it runs, then issues it to an executor. The executor does exactly what was issued and never starts anything on its own.
- Only executors connect to devices: the platform, the web console and the model never connect to devices directly. Quick checks in the toolbox, such as Ping and port checks, are also authorized and recorded by the platform when you are online.
- No inbound access needed: executors connect out to the platform to pick up tasks, and the platform never pushes commands into your network. The PC running a standalone executor only needs outbound HTTPS access to the Topolux platform.
Credentials: encrypted, two ways
- Phone vault: device credentials kept in the phone’s vault are encrypted on the phone, and the platform cannot decrypt them. The app is unlocked with your phone’s biometrics or screen lock.
- Stored encrypted by the platform: credentials entered on the web, and credentials for standalone executors, are stored encrypted by the platform and released to the standalone executor only to run an authorized task.
Device identity: stop when a host key changes
The first time an executor connects to a device, it records the device’s host key. If the key ever changes, the steps for that device stop and a card in your to-do list asks whether to keep trusting it. Other devices carry on. Only a host key the executor actually observed can be trusted; you cannot type one in.
The model: proposals only, never the raw text
- Proposals only: analysis that uses a large language model produces proposals and suggestions only. The model never connects to devices and never approves anything for you.
- Raw configurations and logs are never sent to the model, and whatever does reach it is redacted first.
- Features that use the model are rolling out during the trial, so not every account can use them yet. Inspections, checks and reports that do not use the model are judged by thresholds and rules.
Decisions: you click, and it is recorded
- Approval means a click: anything that needs your approval shows up as a card in your to-do list, and only a click on the card’s button counts. Typing a reply never approves anything.
- Nothing is approved by timing out: if a card that needs your approval goes unanswered, it expires by canceling the task or failing that step. Neither expiry, a system default nor model output can approve anything or trust a host key.
- Approval is tied to the content: you approve the exact version that will run. If the devices, scope or execution location change, it needs approving again, and the old approval cannot be used.
- Every answer is recorded: who answered, when, which version and what they chose. Records are never changed once written.
Baseline: it counts only once confirmed Rolling out during the trial
A business baseline the system works out takes effect only after you confirm it, and anomalies are judged only against the confirmed baseline.
Evidence: you can check it
Every finding opens to the command output collected at the time. Report PDFs are checked for integrity automatically after download.