Security and privacy
An agent with privileges demands real guarantees.
These are the design decisions we made so that protecting your devices never puts your devices or your people at risk.
Three access realms, nothing shared
Customers, NextAnalyzer staff and devices have separate accounts, secrets and routes. Everything your organization sees is filtered by organization.
A two-process agent
A service with no interface does the privileged work, and an unprivileged interface in the tray only shows status. A bug in the interface does not hand over control of the system.
Reversible, audited changes
Before touching the firewall, DNS or web blocking, the agent saves the previous state and restores it on uninstall. Scripts and software are not undone automatically: that is why an administrator approves them and the platform signs them. Every action is kept in the audit log.
Optional, visible, limited history
Off by default. Only the owner turns it on with a declaration, it stores applications and domains (never content or screenshots), shows a permanent notice to the user and is deleted according to your plan's retention.
AI with minimized data
Before anything is sent to a model, identifiers are removed or replaced. Activity history is never sent, and the score is computed by the platform, not by the AI.
Remote access with permission
The person using the device accepts each session and chooses what to allow, unless an administrator enables unattended mode for a group. They always see a notice with who is connected and can end it. It is end-to-end encrypted and any recording is kept in the technician's browser, not on the platform.
Signed scripts only
The agent only runs scripts from your library: a technician writes them, an administrator approves them and the platform signs each version. The agent checks the signature before running them.
Protected access
Two-factor authentication with an authenticator app, reviewable sessions, invitations that expire and single sign-on (SSO, OIDC) on Enterprise.
Audit of everything sensitive
Who did what and when: settings changes, remote commands, history queries and support access to your organization, which you can review.
Detection without exposing anything
Detection relies on Wazuh, which is not reachable from outside: only the NextAnalyzer API queries it, always filtering by your organization.
Your data
What the agent collects and what it never collects
Just what is needed to protect you, and nothing more.
What it collects
- Device inventory: system, installed programs and system users.
- Protection status: firewall, antivirus and disk encryption.
- Usage metrics: CPU, memory, disk and network.
- Ports open to the network and their risk level.
- Device network data: private IPs, gateway, MAC and the public IP, which can be turned off.
What it never collects
- The content of your files, emails or messages.
- Full web addresses: only domains, and only if you turn on history.
- Screenshots. The screen is only streamed during a remote session that the person using the device can see at all times, and it is not stored on the platform.
- What is typed on the keyboard.
If you turn on activity history, the agent also records the applications used and the domains visited, with a visible notice for whoever uses the device.
Artificial intelligence
What reaches the AI and what never does
The AI only works when someone asks for an analysis, and always with a minimized copy of the data.
What it receives
- Each device under an alias (device-xxxxxx) instead of its name. The platform translates it back when it shows you the answer.
- Open vulnerabilities and alerts: CVE, severity, whether they are being exploited and whether there is a fix.
- Protection and system status: firewall, antivirus, encryption, disks and risky ports.
- Counts, never lists: how many apps, accounts or administrators a device has.
What it never receives
- User names, system accounts or email addresses.
- Public IPs, IPv6, MAC addresses, URLs or internal host names. For private IPs, only the range.
- Activity history, log lines, serial numbers or the list of installed apps.
- The call on your risk: the health score is computed by the platform with a fixed formula and the AI only explains it.
Everything the AI writes is labelled so you review it before acting. Each plan has a monthly analysis quota; if it runs out or the AI doesn't respond, the dashboard and reports keep working with rule-based text.
Start protecting your devices today
14 days of the Business plan, up to 5 devices and no card needed. In a few minutes you will know how your fleet is doing.
No card needed. Set up in minutes.