Documentation › Administration
Security & privacy
Your data stays with you#
Steward IT Census runs entirely on your own server. Inventory data, credentials and settings are stored there and are never sent to the vendor or any cloud service. License activation is offline. The server connects out only to: the devices you scan, your domain controller and mail server; once a day the public vulnerability feeds (OSV, Canonical, Microsoft, the NVD, the Arch Linux tracker and CISA) for the operating systems your assets run, and steward-it.com for the version check (a small public file); once a week endoflife.date for end-of-life data; and the services you set up yourself (Let's Encrypt and your DNS provider, warranty lookups at Dell and Lenovo, Microsoft Entra ID / Azure, Google Workspace, AWS, hypervisors, news feeds, integrations). The downloads are plain public files: nothing about your network is sent, and each can be turned off (vulnerability files can be uploaded instead).
Encryption#
| What | How |
|---|---|
| Web interface and agent traffic | HTTPS (TLS 1.2+). The server creates its own certificate; browsers can get a Let's Encrypt certificate for your domain (HTTPS certificate), or you install yours. Responses carry HTTP Strict Transport Security, so browsers that have visited the console once refuse plain HTTP to it for a year. |
| Agent → server | HTTPS with certificate pinning, plus a shared agent key. Since 0.33.0 each agent also registers its own key and signs every request with it, so the shared key can only add new agents, never pose as an existing one. |
| Stored credentials (WinRM, SSH, SNMP, LDAP, SMTP) | AES-256-GCM, with the key kept in secret.key outside the database. A stolen database backup alone doesn't reveal passwords. |
| Login passwords | bcrypt hashes |
| WinRM over HTTP | NTLM message encryption |
| Deployment files | Downloaded with one-time links and verified by SHA-256 on the target |
Access control#
- Administrator, Viewer and custom roles with exactly the permissions you choose, e.g. technicians who may run actions but not see screenshots (see Configuration).
- A sign-in policy you set: sign-out after inactivity, maximum session length (12 hours by default), minimum password length, and a lockout of a login name after repeated wrong passwords (in addition to throttling by address). Plus protection against cross-site request forgery and clickjacking.
- Custom SQL reports run on a read-only connection and cannot read password, session, token, credential or settings tables.
- A password reset by an administrator signs that login out everywhere; a login changing its own password ends its other sessions.
- Each Census agent signs its requests with its own key, and a computer stays with its agent: the shared agent key found in installers can add new computers, but can't pose as an existing one or take over its deployments (see the agent).
Powerful features, kept accountable#
Deployments, scripts, the console, remote commands, uninstalls and screenshots execute on your computers with administrative rights, just like the same features in any management tool. They need the matching permission (administrators have them all) and are recorded: every deployment shows who started it, actions are written to each asset's change history, and every change and sign-in is in the Audit log (Configuration › Audit log).
Remote scanners#
Remote scanners connect out to the server and authenticate every request with their own key pair (created on the scanner; only the public half is sent). Requests are signed, time-stamped and can't be replayed. A scanner only receives the credentials an administrator allowed for its site, encrypted for that scanner (X25519 + ML-KEM-768 hybrid: post-quantum, scanners 0.51.1 and later), for the hosts that need them, and only for the duration of a scan; every credential sent is in the site's audit log. The server checks every result: only addresses of the scan target, only with a credential it sent for that host. The optional -device-listen address serves only agents and scanners, never the web interface.
SSH host keys#
Linux/macOS host keys are trusted on first use and checked afterwards. If a key changes, scanning stops for that host until you clear the stored key, which prevents your stored password from being sent to an impostor.
Census Action Launcher#
The optional launcher on admin PCs only opens a fixed list of tools for a validated host name. A malicious web page can't use it to run commands.
What the agent collects#
Hardware, OS, network configuration, installed software, services, startup items, local users and groups, user profiles, security status (antivirus, firewall, BitLocker, TPM), disks, certificates, event-log errors, and the security settings used by the compliance checks. Administrators can add registry values, files and folders to collect: see Registry and file scanning.