What the appliance secures by default, and the settings that are the operator's job before it carries production traffic.

The appliance ships closed rather than open: it will not serve traffic before it is configured, it will not run without a verifiable licence, and it creates no default account. What it cannot do is choose your secrets, your allowed origins or your retention periods. Work through this list before the appliance carries production traffic.

What do I need?

Licence: Any
Role: admin_user

Prerequisites

The appliance has completed the first-boot setup wizard and holds a valid licence or a live trial.
You can sign in to the dashboard with a tenant that has the admin_user role.
You can edit the appliance's environment file on the host, and restart the stack afterwards.
You know which of your regulatory regimes sets a minimum retention period for audit records.
For an inline-inspection deployment: the addresses your web gateway connects from.

What the appliance already does

Control	Default behaviour
First boot	The product is hard-locked with `SETUP_REQUIRED` until the wizard completes, so nothing serves half-configured
Accounts	No default account and no default password. The wizard creates the only administrator
Licence	Release images enforce licensing. An appliance that cannot verify a licence fails closed rather than running unlicensed
Database schema	Owned by versioned migrations. Automatic schema synchronisation is off on every release image
Provider API keys	Encrypted at rest and never returned by the API
Gateway API keys	Stored as a hash. The key itself is displayed once at creation and cannot be shown again
TLS private keys	Held on the appliance host with owner-only permissions. The application container sees only public certificate material
Write-only secrets	The directory bind password and the SMTP password are accepted but never returned — the API reports only whether one is configured
Read-only role	The `viewer` role is refused every mutating request globally, with `READ_ONLY_ROLE`
Updates	Signature-verified before anything changes, and rolled back automatically if the new release is unhealthy

What you must do

Set a real signing secret

Set JWT_SECRET in the appliance's environment file to 64 hexadecimal characters from a cryptographic random source, then restart the stack.

The gateway refuses to start when the value is a known placeholder. When the value is unset it generates a random one per boot, which invalidates every session on restart and — because the same secret derives the keys protecting the stored directory bind password and the provider API keys — makes those values unreadable afterwards. Set it once and treat it as permanent: rotating it requires re-entering those secrets.

Set the database and cache passwords

Set DB_PASSWORD and REDIS_PASSWORD in the environment file to values you generated for this deployment, and confirm neither service is reachable from outside the appliance.

DB_PASSWORD is the one the operator sets — the container's own POSTGRES_PASSWORD is derived from it, and falls back to a well-known default when it is unset, silently. The stack refuses to start at all without REDIS_PASSWORD. The appliance's own services are the only intended clients of either; neither port belongs on a network your users can reach.

Decide whether reversible masking is on

Set PII_MAP_ENCRYPTION_KEY to 64 hexadecimal characters if you want masked values restored in replies, and leave it unset if you do not.

Unset is the more private setting: the per-session map is never written and responses stay masked. Set it deliberately, and back the value up with the database — without it the stored maps cannot be read.

Restrict which browser origins may call the API

Set CORS_ALLOWED_ORIGINS to the exact origins your dashboard and extension are served from.

Unset means same-origin only, which is correct when everything shares one hostname. Set it on any deployment where the dashboard, the extension or a client application lives on a different origin than the API — and list origins, never a wildcard.

Close the provisioning endpoint

Leave PROVISION_TOKEN unset unless you are provisioning tenants from an external system, in which case set it to a value generated for this appliance.

Unset, the endpoint refuses every request. There is no middle state.

Get off the setup-time certificate

Select Settings → Certificates and confirm the Mode is the appliance CA or your own certificate, not the setup-time self-signed one.

The page names the mode explicitly. Follow Naming, DNS and TLS to change it and to distribute the root certificate.

Name the peers allowed to reach the inspection listener

On an inline-inspection deployment, open Browser Inspection, set Allowed ICAP peer IPs / CIDRs to the addresses your web gateway connects from, and save.

Left empty, any host in private address space may connect. Setting the field replaces that default rather than extending it, so list every peer — cloud gateway egress ranges as well as on-premises appliances. Treat this as one control among several: the listener cannot authenticate its peer, so firewall the port to the same set of addresses.

Set retention to your regime, not to the default

Select Settings → Data Retention and set a period for each class of record.

The page shows which classes are still on the shipped defaults and what is already past its window. Audit and detection records are evidence: choose the longer of what your regulator requires and what your own incident process needs.

Decide how password resets are delivered

Select Settings → Password delivery and choose a channel.

On a network with no mail relay, keep the administrator-issued link: nothing is sent, and a superadmin generates a one-time link and hands it over. Choosing a mail channel and leaving it incomplete is worse than choosing neither — the appliance reports such a channel as unusable rather than discovering it at the moment someone needs a reset.

Export licence and security events to your SIEM

Select Settings → SIEM Export and configure a destination.

Licence lifecycle events are classified as security events, so expiry reaches an alert rule instead of waiting for someone to open a page. Confirm at least one event arrives before you rely on it.

Protect the appliance at the platform level

Restrict who can manage the virtual machine, snapshot it, or attach its disk, and encrypt the datastore it lives on.

The appliance holds its own TLS private keys and its database. Anyone with hypervisor-level access to the disk or to a snapshot has both, regardless of what is configured inside the appliance. This control belongs to your virtualisation platform and cannot be delegated to the product.

Warning

Treat the settings above as a set. Encrypting provider keys at rest is worth little if the signing secret is the shipped placeholder, and a strict origin allowlist is worth little if the inspection listener accepts any peer on the LAN.

Verify

Restart the gateway and confirm it starts cleanly. A placeholder signing secret stops it with a named error rather than starting insecurely.
Sign out, then request a page as an unauthenticated client. It is refused rather than served.
From a browser origin that is not on your allowlist, call the API. The request is refused by the browser's origin check.
On an inline-inspection deployment, connect to the inspection listener from an address that is not on the allowlist. The connection is refused.
Open Settings → Data Retention. No class of record still reads as being on the shipped default.
Trigger one licence or security event and confirm it arrives in your SIEM.

If it fails

The gateway will not start after you set the signing secret → the value is a known placeholder or too short. The startup error names which.
The dashboard loads but every API call fails from the browser → the dashboard's origin is not in the allowlist, or the allowlist was set without restarting the gateway.
The web gateway stops reaching the inspection listener after you set the peer allowlist → the address it actually connects from is not the one you expected. Read the address the listener recorded before widening the list.
The dashboard is unreachable over HTTPS after a certificate change → Certificate expired or nothing on 443

Next steps

Backup and restore — the secrets you just set have to survive a rebuild, or the encrypted data does not.
Naming, DNS and TLS — the certificate half of this checklist, in full.
Decommission an appliance — how to take the same appliance out of service cleanly.

Hardening checklist