What leaves the appliance
Every connection the appliance opens, and every byte that leaves the customer site.
Statement
Statement
DHCP Shield Pro does not phone home. The appliance does not contact any service controlled by us during normal operation. There is no anonymous telemetry, no usage-metrics upload, no crash-reporter, no feature-flag fetch.
Outbound
What data leaves the appliance
Two things, and only two, can send data off the appliance — and both are turned on by an operator, not by us. Until one of them is enabled, nothing leaves.
- In normal operation: none. All DHCP telemetry stays in the customer's local ClickHouse. No metrics, no crash dumps, no anonymised samples, no license phone-home. The license signature is verified on the appliance itself, offline.
- Integrations you wire up (off until configured): the appliance can expose a Prometheus metrics endpoint — platform and application health only, no per-device or per-MAC traffic data — and can emit its own event outputs to a downstream pipeline you run, which can in turn route to your existing SIEM or log store. These send only where you point them, inside your own network.
- Software updates: customer-initiated download from this website only. The appliance does not auto-update.
Support
Support session (operator opt-in)
The only path back into the appliance is a support session that an administrator explicitly opens — an outbound connection the customer initiates. Nothing reaches the appliance unless an operator starts it, and the scope is chosen at session start. To change scope, the session is ended and restarted.
- Feedback packet (per-send): a bundle of screenshot, context, and diagnostics attached to a support ticket — sent only when the operator chooses to send it.
- Chat, console control, and MCP tools: on by default for troubleshooting, but only within an open session. The MCP tools expose the same read-oriented surface as the product's own integration; writes require an admin token.
- Screen cast and root shell / terminal: off by default. A buyer can cite this as a procurement assurance — remote screen viewing and shell access are never on unless an operator turns them on, and the terminal carries a per-session consent banner.
The operator can revoke the session at any time. See Trust Center · Air-gapped · Updates and support and the DPA for the processor scope and retention terms.
Forms
What we collect from public marketing forms
Distinct from the appliance: when a visitor uses a contact, demo, or quote form on this website, the Go fulfillment service stores only what the form asks. The fields collected, retention, and handling are documented in /legal/privacy.
Keep reading
Related
Nothing leaves without your say-so.
See how the same offline posture carries into licensing and air-gapped deployment.