Security

The appliance opens outbound connections to our service and to nothing else. It listens on no port on any interface. There is no inbound path from us on any interface, including cellular where a site allows a modem as a second uplink. Your team can confirm this with a port scan.

A fanless industrial PC with a TPM 2.0 chip, running Linux, our three services in containers, and nothing else. The disk is encrypted at rest and unlocks only on this hardware. It sits on the network segment where the robots publish and subscribes to their traffic; it has no write path to any robot topic, no publishers, no services. That passivity is checked by a lint at build time and by a runtime check at startup.

Every minute: a heartbeat of about 500 bytes with health, versions, disk, clock, and the last events. At every seal, every five minutes: the fingerprint of the sealed record. At the close of each period: the derived findings and period summaries (counts, rates, hours of motion, worst examples with references), which is what the reports are built from; no raw messages and no positions of people are in them, and the scope is fixed in the signed configuration your team approved. Nothing else leaves unless someone with the right to act on your appliance asks for a window to be preserved and uploaded, or exports a report. Each of those actions is written into the record itself.

Every message is chained the instant it arrives; every five minutes a segment is sealed and signed by a key that was generated inside the appliance's TPM and cannot leave it. Our service countersigns a receipt for every fingerprint it receives, and that receipt is written back into the record. A verifier ships with every evidence package.

What this proves and what it does not: the chain and the signatures prove the record was not altered after it was sealed. They do not prove a robot's sensors were correct. If a robot published a wrong value, the record holds the wrong value faithfully, and says so when it can tell.

Software arrives as signed container images, verified against our signing key before anything runs. Updates apply in a window you declare (default 03:00 to 04:00 site time): the recorder seals, records the stop, swaps, records the start, and watches itself for a probation period; if it does not come back healthy it rolls back on its own and refuses that version afterwards. Every update is an entry in the record.

SSH is off. Nothing listens on the box. Access for your IT team and for our support, and the record of every session, are set out in the pilot agreement; we never hold a key to your box.

The recorder and agent that run in your rack are available to customers for audit under the pilot agreement, with a software bill of materials on request. The service side is ours.

The record is only as complete as what the fleet publishes and what the network delivered; we measure and declare loss rather than hide it. The operator's own mirror of the sealed records is the independent copy.

security@roboblackbox.com. We acknowledge within two business days and we do not pursue good-faith researchers.