Procurement · security review
Before it is allowed into the network

Nothing calls home.
Start there, and check the rest.

The questions a carrier's procurement and security teams ask are not the ones in a datasheet. They are about dependence: what leaves the building, who can see what, what happens the day the vendor is unreachable, and whether the platform will admit what it cannot see.

Most infrastructure buying decisions are reversed by a single discovery: that the thing you bought needs someone else to keep working.

0
calls to us from your gateways
Ed25519
signature on every update
1
switch freezes fleet updates
4
roles, each with a stated permission set

The short answers

Does the gateway need to reach you to forward traffic?
No. There is no licence check, no activation call and no telemetry destination outside your network. The forwarding path has no dependency on us existing.
Where does subscriber data go?
To NOC2, the operations platform we run. It is a hosted service, and we say so plainly — your gateways send their telemetry to it, and your staff sign in to it. What it never does is scope beyond you: your account sees your gateways and nothing else.
Can an update be pushed to our fleet without our consent?
No. Updates are cryptographically signed and verified before installation, the signing key lives on your server, and a single environment switch freezes updates across the whole fleet.
What happens if you go out of business?
Your subscribers stay connected. The gateways forward, authenticate and enforce policy with no dependency on us whatsoever — no licence check, no activation, no heartbeat. You would lose the hosted console, not the network.
Will the monitoring tell us when it is broken?
Yes — explicitly. The console audits its own collectors and states its coverage as a fraction, because a broken instrument and a healthy network look identical from the outside.

What crosses your boundary

NOC2 is a service we host — we would rather say that in the second sentence than let you find it in a diagram. What matters is which side of the boundary each thing sits on.

What crosses the boundary, and what never does Subscriber traffic, authentication and enforcement all stay inside the operator's network. Gateways report telemetry outward to the hosted NOC2 console, which operator staff sign in to and which scopes each account to its own gateways. No gateway asks the console for permission to forward. YOUR NETWORK Gateways forwarding · CGNAT · protection Your RADIUS authentication · policy Subscriber traffic never leaves this box and no gateway asks anyone for permission to forward it NOC2 — hosted by us telemetry, alerts, the console your staff sign in here scoped to your gateways only telemetry What the console is not It is not in the forwarding path. Switch it off and traffic is unaffected. One arrow crosses the boundary, it carries measurements rather than customer traffic, and nothing comes back that the network depends on.

We checked this the way you should check it: by looking for outbound destinations compiled into the software, rather than by asserting a policy. The agent contains no address belonging to us at all — no licence server, no activation endpoint, no separate metrics sink. It reports to the console endpoint it was enrolled against, and that is the only place it talks to.

Which is the distinction that matters in a security review. A hosted console is a service you can evaluate, replace, or lose without consequence to traffic. A licence server in the forwarding path is a dependency you cannot escape. We have the first and not the second, and those are not the same risk.

Updates: signed, verifiable, and stoppable

An auto-updating agent on eighty gateways is either a great convenience or the most efficient way ever devised to break a network. The difference is entirely in who can authorise one.

Signed

Every release carries a signature

Agent builds are signed with an Ed25519 key, and an agent verifies the signature before it will install anything. An unsigned or tampered build is refused, not warned about.

Verified

The agent checks before it installs

Verification happens on your gateway, not on the server that offered the update. A build that fails the check is refused outright — there is no path by which an unsigned binary reaches your data plane.

Stoppable

One switch freezes everything

A single environment variable makes the server offer no update at all to any agent. During a change freeze, an incident, or an audit, the fleet simply stops taking new versions.

Be clear about what this does and does not protect. Signing guarantees that what installs on your gateway is the build we published, unmodified. It is not a claim that you control our release schedule — the freeze switch is what gives you that, and during a change freeze or an audit it is the control to use.

Who can see what

Access questions in an RFP are usually answered with the word "RBAC" and no further detail. The detail is the answer.

NOC2 Roles page showing four built-in roles with levels and explicit permission counts.
Four built-in roles, each with an explicit permission count and level. Master Admin holds 55 permissions, Super Admin 54, Team Admin 31, Staff 13 — and the difference between them is inspectable rather than described. Custom roles can be created from the same permission set. The distinction that matters for a multi-operator deployment is not the role name but what it can see: authorisation for "which gateways may this account touch" resolves through one path, so a new page cannot accidentally widen it.

The platform states what it cannot see

This is the section we would most like a security reviewer to read, because it is the one that is usually missing.

Every monitoring system has blind spots: a collector that never ran, a probe deployed to half the estate, a gateway that stopped reporting last Tuesday. The dangerous property is not having them — it is presenting a number computed from a partial sample as though it described everything.

NOC2 System Integrity page listing collectors that are current, one that has never received a row, and coverage stated as a fraction of the fleet.
NOC2 audits its own instrumentation and publishes the result. Each collector is reported as current or not, with the age of its most recent row. Coverage is stated as a fraction — 42 of 80 gateways have an SLA probe — together with the consequence in plain words: anything computed from it describes a sample, not the fleet. A collector that has never received a single row is called broken rather than shown as zero. The page's own summary line is the argument: a broken instrument and a healthy network look identical from the outside.

Ask every vendor on your shortlist for this screen. Not the dashboard — the page that says which parts of the dashboard are currently lying. If they cannot show you one, the honest reading is that their coverage gaps are invisible to them too.

Safety functions are never licence-gated

Commercial controls exist. They apply to capabilities, not to the things that tell you the network is on fire.

The failure mode we designed out

A licensing state changes — an expiry, a counter, a mistake in a record — and alerting quietly stops for the affected operators. The network keeps having problems; nobody is told about them.

This is a genuinely dangerous pattern, because the symptom of it is silence, and silence is indistinguishable from health.

The rule

Alerting, incident detection and the operational console are never gated by licence state. A commercial dispute may stop you enabling a new capability. It does not stop you being told a gateway is down.

Enforcement also carries an explicit switch, so the behaviour can be disabled outright rather than reasoned about.

What you are actually buying

DimensionPosition
DeploymentGateways on commodity x86 in your racks. The NOC2 console is a hosted service we operate.
Runtime dependency on the vendorNone in the data plane. No licence call, no activation, no heartbeat. Losing the console does not interrupt a single subscriber.
Subscriber data locationTelemetry is held in the hosted platform, scoped to your account. Subscriber traffic itself never leaves your network.
Update authoritySigned releases, verified on the gateway, with a fleet-wide freeze switch.
Access controlFour built-in roles plus custom roles; per-operator scoping of which gateways an account can see.
Instrumentation honestySelf-audit page stating broken collectors and coverage as a fraction of the fleet.
Hardware lock-inNone. Standard servers and standard NICs; sizing is measured on the hardware you intend to buy.

The bottom line

A supplier relationship should be a commercial arrangement, not a technical dependency. The test is simple, and you can apply it to every vendor you are evaluating: if they vanished this afternoon, what stops working?

Here the answer is: the console, and new software versions. Not forwarding, not authentication, not CGNAT, not the protection stack, and not a single subscriber session. The dependency is on the part you would replace, not on the part that carries your customers — and that is the distinction worth holding every vendor to.

About the screenshots. Every screen shown is a real production console. Gateway hostnames, operator names and site names are replaced with placeholders, and every address is replaced with one from the RFC 5737 documentation range, before the image is taken; no operator, site, region or subscriber identifier appears in any image.