Security
Built to be allowed through the firewall review.
The questions a security team asks first — what connects where, what runs on our servers, and who can see what — answered with how the platform actually works.
How it works
What connects, and in which direction.
Outbound-only connectivity
Everything at your site connects out to Ceburu over HTTPS on port 443. Nothing in Ceburu’s cloud ever dials into your network, so there are no inbound firewall holes to open.
One egress point per site
A Ceburu Probe at each site runs discovery and commands and is the single egress point. End agents need no internet access at all; the probe serves their installers over your LAN.
Agentless where possible
Servers are monitored over WinRM, SSH, SNMP and vSphere. Databases are polled remotely with read-only queries — nothing is installed on the database server. Network discovery needs no credentials.
Separated by tenant and site
Companies contain regions or sites, each with its own data and keys. Modules are enabled per customer.
Central sign-in
People sign in through the Ceburu account portal, with identity integrations available.
Resilient by design
The collector keeps a persistent on-disk queue and the log forwarder a write-ahead log, so a WAN outage buffers data instead of losing it.
Architecture
Every connection, on one page.
Select a component to see its role.
Your site
Site edge
Disk buffers on the collector and forwarder hold data through WAN outages.
Ceburu
Ceburu Probe
One per site. Runs discovery and commands, serves agent installers over the LAN, and is the single egress point to Ceburu.
Have a security questionnaire?
Send it over. We’ll answer it with the details of your deployment, and set up a call with an engineer if it’s easier to talk it through.