Security and your data

This page says what the service does today. We do not hold any security certificate and we do not claim one.

One database per ISP

Each ISP has its own panel at its own address and its own database. Your OLTs, ONUs, customer names and history are not stored in the same database as those of another ISP.

How passwords are stored

OLT passwords are stored encrypted (AES-256-GCM). The SNMP community is stored encrypted in the same way.
Your panel password is stored as a bcrypt hash. We cannot read it. If you forget it, you choose a new one by email.
The sign up system does not store your password. You type it after your email address is confirmed and it goes straight to your new panel.
Email links for sign up and password reset are stored as hashes, not as the link itself. A reset link works for 60 minutes and can be used once.
OLT configuration backups are stored encrypted.
The activity log keeps what the OLT answered, to help you find problems. Passwords are not written to it.

HTTPS and cookies

The site and every panel are served over HTTPS.
The sign in cookie is HttpOnly, Secure and SameSite=Strict. Scripts cannot read it, it is only sent over HTTPS, and other websites cannot send it with their requests.
You get a new session when you sign in.
Forms that change something carry a secret token, so another website cannot send them in your name.

What the panel changes on your OLT

Reading is automatic: status, signals and new ONUs, every 5 minutes.

The panel only changes the OLT when you press a button for it, such as authorize, reboot, disable, delete or a VLAN change. The one exception is a rule you set up yourself: an auto action authorizes new ONUs for you with the preset you chose. There are no auto actions until you create one.

Rebooting or disabling more than ten ONUs at once asks you to type the exact number first.
Every action is written to the activity log with the user, the time and the IP address.
If the OLT refuses the login, automatic reads stop until you save the OLT settings again. This protects the login on the OLT from being locked.

VPN rules

If your OLT has no public address, a MikroTik router on your network connects to our OpenVPN server. The firewall on our server applies these rules to every tunnel:

Only our server opens connections to your OLT. The tunnel is used in one direction.
A router on the VPN cannot open connections to our server. It can only answer the server, and ping it.
Routers on the VPN cannot reach each other. Traffic is never forwarded from one ISP to another.
Our server does not forward traffic from any other network into your tunnel.

On your side, the ready made MikroTik script:

gives each OLT its own VPN username and password
forwards only the Telnet port of the OLT, and the SNMP port if you turned SNMP on

The script is shown in your panel and you can read every line before you paste it. See connect with OpenVPN and MikroTik.

Telnet itself is not encrypted. With the VPN, the Telnet session travels inside the encrypted tunnel between our server and your router. With a direct connection to a public address, it travels over the internet as plain text. If you use a direct connection, limit the Telnet port on your firewall to our server, or use the VPN.

One panel per email address. Capital letters and a +tag in the address do not make it a new address.
Nothing is created until you open the link in the confirmation email.
The number of emails is limited per address, per network and per day for the whole service.
Forms sent by robots are refused.
A sign up that is not confirmed is deleted after 24 hours.
The password reset form gives the same answer whether or not the site name and email address match, so it cannot be used to test addresses.

What we can see

We run the server, so we are technically able to open a panel and its database. We do this only to give support you asked for or to keep the service working.

What we do not promise

We do not hold security certifications.
We make no promise about backups of the panel database. Keep your own copy of what matters: you can export your ONU records from the panel, and download your OLT configuration backups.
We make no promise about availability. See the terms of use.

Your part

Choose a strong panel password and do not share it. See account and password.
Create a separate user on the OLT for the panel.
If a technician leaves, change the panel password and the OLT password.

Report a security problem

If you find a security problem, write to support@ispledger.com. Tell us what you found and how to see it. Please do not test on panels that are not yours, and do not make the problem public before we have had time to fix it.