Security
Your passwords never leave your network
VMSTools Pro was designed for surveillance networks that are meant to stay closed. Here's exactly what leaves your network, and what never does.
The short version
-
XProtect passwords stay local
Stored on the agent's machine only. The cloud never receives them.
-
Outbound only
The agent only makes encrypted connections out. It doesn't listen on any port, except during a port-forwarding test you start yourself.
-
No video in our cloud
Video stays on your Recording Servers. Exports go to storage you choose.
-
Camera passwords are never collected
The agent works through your Management Server and never needs them.
-
Your data is kept separate
Every query is scoped to your organization, and no other organization can see your data.
-
MFA and step-up checks
Authenticator-app MFA, and a recent MFA or password check before custom scripts run.
What leaves your network
The agent sends:
- Health data from each machine it runs on: CPU, memory, disk, network, running processes and Windows services
- XProtect configuration needed for reports: servers, cameras, storage and recording settings
- Results of the reports and tools you run
- Camera snapshots, when you capture them in any tool
- XProtect audit log records, if you turn on audit log collection
- The agent’s own details: the machine’s name, its local IP address, your network’s public IP address, and the name of the XProtect account the agent signs in with, so the agent’s own activity can be filtered out of your audit logs. To find the public address, the agent asks a public lookup service (
api.ipify.org). If that’s blocked, the dashboard leaves the field empty.
Everything travels over an encrypted connection (TLS) and is stored for your organization only.
What never leaves
- Your XProtect passwords, including the agent’s own password
- Camera passwords
- Video footage
Who can do what
Every account belongs to an organization. Its owner decides who has access and with which role: Owner, Admin, Operator or Viewer. Sign-in supports authenticator-app MFA. Failed sign-ins, failed MFA attempts and blocked scripts trigger security notifications by email or SMS.
Leaving
You can export audit logs and camera reports to CSV at any time. To remove the agent, run the uninstaller that comes with it.
Security questions we hear
- Do you store my XProtect password?
No. The agent stores it on your machine and uses it to talk to your Management Server. It's never sent to the cloud.
- Do I need to open any firewall ports?
No inbound ports. The agent needs outbound HTTPS to
connect.vmstools.proon port 443.- Does video go through your servers?
No. Video stays on your Recording Servers. Exports are written by the agent to a location on your own network.
- What camera information do you collect?
The camera report collects each camera's name, network address, username and MAC address so it can report on them, and stores the results for your organization only. Camera passwords are never collected.
- Who can run scripts on my system?
Only people your organization's owner allows. Custom scripts also require:
- a recent MFA or password check
- permission for every kind of command in the script
Scripts that use a wider set of commands must also be approved on site, in the VMSTools Pro tray app on the server or by text message, before they first run.
- What does the AI see?
AI features run only when someone starts them. They work from health and configuration data, never from your XProtect passwords, camera passwords or video. The AI Advisor shows the data it used alongside each answer.
- Can I revoke an integrator's access?
Yes. Your organization owns its account. If you've granted an integrator access, you can remove it at any time.
Questions about your environment?
Read the Privacy Policy, or apply and tell us about your network. We're happy to answer security questionnaires.