Security
Built in, not bolted on
Because you host Holdfast, security starts with a simple fact: your data never leaves infrastructure you control. From there, every connection is authenticated, every agent is identified, and every capability is granted explicitly.
Your own certificate authority
Holdfast runs an internal CA. Every agent gets its own certificate, and the server trusts only certificates it issued. There is no shared secret to leak and no external identity provider in the trust path.
Mutual-TLS everywhere
Agent-to-server traffic is mutually authenticated: the server proves its identity to the agent and the agent proves its identity to the server on every connection. Both ends verify before any data moves.
Gated enrollment
New agents join with a single-use token. Enrollment can be further restricted per tenant by IP allowlist, and agents pin the server's CA fingerprint so a machine will refuse to trust an impostor server.
Bounded self-service
What end users can do — back up, restore, reconfigure — is governed by tenant policy and per-device overrides. Least privilege is the default; you grant capabilities explicitly.
Resource limits
Agents can be capped on CPU and bandwidth, per person and per device, so protection never competes with the production work the machine exists to do.
Auditable + observable
Administrative actions are audited, and events can stream to your SIEM as RFC 5424 syslog per tenant — so security operations sees Holdfast the same way it sees everything else.
Ownership is the strongest control
The safest place for your backups and operational data is infrastructure you own and understand. Holdfast is designed so that's exactly where it lives.