Machine security
Every machine you activate becomes a device on your account. This is how that identity works, what it is allowed to do, and how to take it away.
What a machine holds
Activating stores two things locally: a signed licence describing your plan, and a device token identifying this machine to the cloud. The token is stored on your machine and only its hash is kept server-side, so it cannot be read back out of our database.
What a device token can do
| Can | Cannot |
|---|---|
| Upload usage metadata for this machine | Read another machine’s data |
| Fetch the team caps that apply to you | Change your plan or billing |
| Refresh this machine’s licence | Sign in to the console or read your email |
It is scoped to one machine and to metadata. It is not an API key for your AI providers — Guardrail never holds those, because it relays the login your tool already has.
Revoking a machine
Open machines in the console and revoke anything you do not recognise, or any laptop you no longer have. Revoking takes effect immediately: that machine can no longer sync, refresh its licence, or fetch team caps, and it drops to Free locally once its current licence goes stale.
Revoking is also the right move if you think a machine was compromised. It cannot be undone from the machine itself — only re-activating with a fresh code restores it.
Turning sync off entirely
If you would rather a machine never talked to the cloud at all, switch sync off. The firewall, policies and local dashboard keep working; the hosted dashboard simply stops receiving anything from it.
guardrail sync off
In transit and at rest
Everything between a machine and the cloud goes over HTTPS, and synced rows are stored encrypted at rest by our database provider. What is sent is metadata only — the privacy model lists it field by field.
To report a security issue, email admin@neatproxy.com. See also the security overview.