Secure configuration guide

The settings we recommend for agencies using Optifi, and what each one protects.

1. Dashboard accounts

Use the three roles as intended. Owners manage the organization and its users. Admins manage sites, devices, policies and updates. Users view results. Give each person the lowest role that lets them do their job.
Keep few Owners and Admins. Only Owners and Admins can see the audit log, change collection policy, start updates or send device commands that change a device.
Use a strong, unique password for each dashboard account, and remove accounts when staff leave.
Review the audit log regularly (Settings › Audit log). It records who changed policies, started or stopped updates, created or revoked enrollment tokens, sent device commands or changed sites, with the time and address used. Entries are kept for 400 days.
Dashboard sessions end automatically after 5 hours.

Treat an enrollment token like a password. Anyone holding it can add a device to your organization.
Choose the shortest expiry that fits the job. Tokens can last 1 day, 7 days, 30 days, 90 days or 1 year. Use a short one for a one-time rollout.
Revoke a token as soon as it is no longer needed (Devices › Add devices). A revoked token stops working at once; devices already enrolled keep working.
Pass the token to installers on the command line or through your device management tool rather than in shared files. The Windows installer does not write the token to its log.

Install only from Optifi's official installers. Windows installers are code-signed by AccessAgility LLC, macOS packages are signed and notarized by Apple, and Android and Linux releases are signed. Agents refuse any update whose signature does not match.
Agents only connect out, over HTTPS (port 443) to Optifi's service. They open no listening ports, except a site gateway, which accepts hourly summaries from nearby Optifi devices on one port you choose.
Remote commands are a fixed list, such as running a network test, scanning for access points or briefly identifying a sensor. No one, including Optifi staff, can run arbitrary programs on a device through Optifi.
By default the agent shows nothing to the device's user. On-screen readouts, the window and lock-screen identity are off until an Admin turns them on.
Keep automatic updates on so devices receive security fixes. You can hold a site on its current version in Settings › Configuration.

Connect sensors to a wired network you control. A sensor generates its own keys on first start; no shared credential is built into the image.
Only turn on "set up new sensors over this network" if a sensor cannot be wired. The WiFi password is readable from the image or card until the sensor first starts, so keep those cards secure and re-image or wipe any you do not use.
If you use the WiFi controller connector, give it a read-only controller account. The controller's credentials are stored only on the gateway, readable only by its system account, and are never sent to Optifi.
Allow the gateway's port only from your own network.

Optifi collects network measurements (network name, access point identifiers, signal, latency, DNS and application reachability) and device inventory (device name, serial number, operating system and network addresses). It does not collect the content of user traffic, browsing history or device location coordinates.
Choose application checks deliberately. Agents only test the addresses you list in collection policy.
Speed tests are off unless you turn them on.
"Hourly summaries" mode keeps raw measurements on each device and sends one summary an hour. It reduces what leaves the device and is the recommended mode.

All data is encrypted in transit (TLS 1.2 or later) and at rest in Amazon Web Services (US East).
To retire a device, uninstall the agent and move the device back to inventory in the dashboard.
To have your organization's data removed, email security@accessagility.com from an Owner's account email.