This article is for IT and security administrators. It explains how the BrynQ Agent protects the connection between BrynQ and your local systems.

Network

• Outgoing connections only. The Agent connects outward to BrynQ through Cloudflare Tunnel (HTTPS, port 443). No inbound firewall ports are opened.
• Encrypted in transit. Traffic between BrynQ and your server runs through the encrypted tunnel. You don't need your own SSL certificate or reverse proxy.
• Local only by default. The Agent itself listens on 127.0.0.1 (port 7070). The local admin dashboard (port 7071) only accepts requests from the server itself and is never exposed through the tunnel.
• Only what you enable. Only the modules selected during installation are available. Requests to other modules are refused.

Authentication

• Every request to the Agent must include the customer (domain header) and a valid token (Authorization: Bearer header). The Agent checks each request with BrynQ. Requests without a valid customer and token combination are refused (401).
• The BrynQ API token used during installation is scoped to exactly one customer. It is stored on the server in platform-auth.json, protected with Windows data protection (DPAPI, LocalMachine), and never passed on a command line.
• Rate limiting: each endpoint accepts at most 120 requests per minute, to protect your systems against abuse.

Credentials and logs

• SQL credentials and other connection settings are stored only on your server, in C:\ProgramData\BrynQ\Agent\config. BrynQ does not send connection strings to the Agent.
• Sensitive values (tokens, passwords, connection strings, Authorization headers) are removed from the log files before they are written.
• Logs rotate daily and are kept for 30 days by default.

Signed software and updates

• The installer, the Agent, the service wrappers, the PowerShell scripts and the uninstaller are all signed with Microsoft Artifact Signing. The publisher shown by Windows is Salure ICT BV, BrynQ's legal entity.
• Automatic updates are signed installers from BrynQ. The Agent checks the SHA-256 checksum before it runs an update, and refuses any file that is not a BrynQ Agent installer.

Verify the installer

Run this in PowerShell, with the path to the downloaded file:

$Installer = "C:\Users\Administrator\Downloads\BrynQ_Agent_<version>.exe"
$Signature = Get-AuthenticodeSignature -FilePath $Installer
$Signature | Format-List Status,StatusMessage,SignerCertificate,TimeStamperCertificate
Get-FileHash -Algorithm SHA256 -Path $Installer

Expected: status Valid, signer CN=Salure ICT BV, a timestamp certificate, and a SHA-256 hash that matches the Checksum on the BrynQ Agent page. Stop and contact BrynQ support if any check fails.