Security

What is encrypted and who holds which key

• Every secret the platform stores is encrypted in the database.
• User passwords are stored only as a hash.
• Off-site backups are encrypted with AES-256-GCM and a per-tenant key. The tenant holds that key.
• A nightly encrypted backup of the platform’s own database, with a weekly restore test.
• TLS pinning to routers.

Roles and 2FA

• Three roles: platform admin, tenant admin, viewer.
• Strict tenant isolation, enforced in the database layer.
• TOTP two-factor authentication.
• In the Telegram bot, sensitive actions require 2FA and only work in private chats.

Audit log

• Every action is recorded in a full audit log.
• Configuration history with diffs, change detection and “who changed it” alerts.

Safe changes

• Staged rollouts of templates and firmware: a canary router first, then batches, halting on the first failure.
• The hardening wizard fixes the findings. If management access is lost, a scheduler on the router itself rolls the change back automatically.
• The AI assistant runs nothing on its own: only through a plan you review, with your explicit confirmation.

Off-site backups

• Copies to your own storage: S3 (or S3-compatible) or SFTP/NAS.
• Restore from a local or an off-site copy.

No lock-in

• Your off-site copies open without RouterPulse, with the standalone mv-decrypt tool and the key you hold.
• If you stop using RouterPulse, the copies in your own storage stay yours.

MikroTik and RouterOS are trademarks of SIA Mikrotīkls. RouterPulse is an independent product of NOIT and is not affiliated with or endorsed by MikroTik.