Security

For off-site communication, the appliance opens outbound connections to our service and to nothing else. The only thing listening is a read-only status page on your LAN interface, with no controls on it; nothing listens on the uplink, including cellular where a site allows a modem as a second uplink. There is no inbound path from us on any interface. Your team can confirm this with a port scan.

A fanless industrial PC with a TPM 2.0 chip, running Linux, our three services in containers, and nothing else. The disk is encrypted at rest and unlocks only on this hardware. It sits alongside robot and facility networks. The documented robot integration subscribes to published traffic; it has no write path to any robot topic, no publishers, no services. That passivity is checked by a lint at build time and by a runtime check at startup.

The architecture uses read-only access to available facility states on the operator’s site network, alongside robot publications. A read-only PLC integration is designed to add no off-site outbound connection and to send no operational data to a cloud service.

Each integration requires an authorized recording scope, read-only credentials or access where applicable, and review of source coverage. No control path is intended to robots, cameras, gates, safety controllers, or emergency stops. Read-only access must be established for each source within the operator-authorized scope.

Every minute: a heartbeat of about 500 bytes with health, versions, disk, clock, and the last events. At every seal, every five minutes: the fingerprint of the sealed record. At the close of each period: the derived findings and period summaries (counts, rates, hours of motion, worst examples with references), which is what the reports are built from; no raw messages and no positions of people are in them, and the scope is fixed in the signed configuration your team approved. If the recorder crashes or an update rolls back, the box attaches a diagnostic bundle (service logs, not recorded data) to its next heartbeat. Nothing else leaves unless someone with the right to act on your appliance asks for a window to be preserved and uploaded, or exports a report. Each of those actions is written into the record itself.

Every message is chained the instant it arrives; every five minutes a segment is sealed and signed by a key that was generated inside the appliance's TPM and cannot leave it. Our service countersigns a receipt for every fingerprint it receives, and that receipt is written back into the record. Evidence integrity is checked using the chain, seals, signatures, and service receipts. Evidence is designed for independent review; package contents and available checking tools are defined for the authorized export.

What this proves and what it does not: the chain and the signatures prove the record was not altered after it was sealed. They do not establish that robot or facility reports, camera estimates, or operator declarations matched physical reality. If a robot published a wrong value, the record holds the wrong value faithfully, and says so when it can tell.

Software arrives as signed container images, verified against our signing key before anything runs. Updates apply in a window you declare (default 03:00 to 04:00 site time): the recorder seals, records the stop, swaps, records the start, and watches itself for a probation period; if it does not come back healthy it rolls back on its own and refuses that version afterwards. A signed security or data-integrity fix may apply outside the window, as the pilot agreement allows; it follows the same steps and you are notified. Every update is an entry in the record.

SSH is off by default. Your team can turn it on as a signed configuration change: LAN only, your keys, a limited operator role with no root shell. Our support connects only through an outbound session you approve, for a limited time. Every session is written into the record, and we never hold a key to your box.

The recorder and agent that run in your rack are available to customers for audit under the pilot agreement, with a software bill of materials on request. The service side is ours.

The record is only as complete as what supported sources publish or observe, the configured scope, and what the network delivered; we measure and declare loss rather than hide it. The operator's own mirror of the sealed records is the independent copy.

security@roboblackbox.com. We acknowledge within two business days and we do not pursue good-faith researchers.