Built for security-conscious network teams
An agent connected to production network devices has real responsibility. Here is how PhysicalLayer handles that access.
Where agent data lives
Credentials remain on your network
SNMP community strings, SSH keys, and NETCONF credentials are encrypted in the agent deployment inside your network perimeter. They never go to PhysicalLayer's cloud. The agent authenticates to devices from within your network.
Telemetry stays tenant-isolated
Counter data, syslog events, and topology state live in a tenant-isolated environment. Telemetry is not shared across accounts or used to train models.
Management plane only
The agent works only on the management plane through SNMP polls, syslog ingestion, and NETCONF. It does not capture or inspect user data traffic. There is no traffic mirroring or inline mode.
Every repair is audited
Each repair action is logged with its triggering telemetry, diagnosis, before/after state, NETCONF payload, and post-repair health check. Logs export as JSON and are retained for 90 days on Navigator plans.
Least privilege by default
The agent uses the smallest required permission set. Read access is separate from write access, which is scoped by device group and action type.
Read-only collector
Telemetry collection uses SNMP read-only credentials and has no device write access. Observer plan accounts remain read-only throughout.
Scoped repair access
Write access is scoped by device group and action type. Permit interface bounces on access switches while core routing stays notify-only. Each action type has its own permission toggle.
Dashboard roles
Admin configures device groups and repair policies. Operator approves queued repairs. Viewer sees telemetry and incident history. SSO is available on Navigator and Enterprise plans.
Deploy near your devices
The PhysicalLayer collector runs on your infrastructure and connects outbound to the cloud. No inbound rules are required.
Docker on Linux, outbound cloud
Run the collector as a Docker container on a Linux host with management-plane access to your devices. It connects outbound to the cloud over HTTPS/443. No inbound rules are required.
Enterprise on-premises
Enterprise plans offer fully on-premises deployment: telemetry, analysis, and dashboard stay in your data center, with no data leaving your perimeter. Deploy on dedicated hardware or as a VM image.