Remote maintenance access
Controlled, recorded access for the engineers who maintain your equipment, approved per work order and limited to the systems they are there to work on.
Most equipment that needs specialist maintenance can now be diagnosed, adjusted and updated without a site visit. The difficulty is letting the right engineers in, and only them, on a network that belongs to somebody else. Remote maintenance access gives your engineers and approved contractors a single, controlled way to reach the equipment you maintain, with the site's owner able to see and approve every session.
Sessions pass through our access gateways in the United Kingdom and North America. Nothing at the site accepts connections from the internet: the site connector makes an outbound link to the gateway, and the gateway only allows a session that matches an approved work order.
How it works
- Your engineer raises a work order on our service desk, or one is raised automatically from your own ticketing system, naming the site, the equipment and the time needed.
- The work order is approved by the person you have nominated for that site, or falls within a maintenance window they have already approved.
- The engineer signs in to the gateway with their own account and a second factor (a security key or authenticator app). Shared accounts are not permitted.
- The gateway opens a connection to the equipment named in the work order, and nothing else, for the time approved. The session is recorded.
- When the work order closes, or its time runs out, the session ends. The recording and the session log are kept for the agreed period and are available to you and to the site.
What you and the site control
- Who: each engineer has a named account, issued by us on your request and removed when you tell us they have left. Contractors' accounts expire automatically.
- What: access is to named devices and ports only. Engineers cannot browse the site network.
- When: sessions are approved one at a time or within maintenance windows, set per site. Sites can suspend all access at any time by calling the service desk.
- Evidence: every session is recorded, with keystrokes for command-line sessions and video for graphical ones. Recordings are kept for 90 days as standard, or up to seven years on request.
Maintenance windows
Larger pieces of work, such as firmware updates across a fleet of installed equipment, are usually carried out in planned maintenance windows agreed with the equipment owner in advance. We schedule the window on the service desk, notify the sites concerned if you ask us to, attend throughout and post a notice on our status page without naming the customer. Engineers' sessions within the window are approved once, for the window as a whole.
Technical summary
| Gateway locations | United Kingdom (two gateways, separate sites); North America (two gateways, New Jersey) |
|---|---|
| Engineer sign-in | Named accounts; FIDO2 security key or TOTP authenticator; single sign-on with your identity provider by arrangement |
| Protocols supported | SSH, RDP, VNC, HTTPS, and TCP port forwarding for vendor service tools |
| Encryption | TLS 1.3 between engineer and gateway; IPsec (IKEv2) or managed private link between gateway and site |
| Site connector | Halsworth SC-2 hardware connector, or a virtual appliance on customer hardware; outbound connections only |
| Session recording | All sessions; 90 days as standard, longer retention by agreement |
| Out-of-band access | Optional cellular or radio management link for sites where the primary link may be unavailable during maintenance |
| Integration | Work orders by email, by web form on the service desk or through a REST interface |
| Service desk | 24 hours a day, 365 days a year, for priority 1 and 2 faults |
Service levels
| Measure | Standard | Enhanced |
|---|---|---|
| Gateway availability (monthly, excluding planned maintenance) | 99.9% | 99.95% |
| Response to a priority 1 fault | 30 minutes | 15 minutes |
| New engineer account | Next working day | Four working hours |
| Notice of planned maintenance by us | Five working days | Ten working days |
| Recording retention | 90 days | One year |
Service levels are set out in full in the service schedule that forms part of each contract. Service credits apply where a monthly availability target is missed. See our terms of business.
Getting started
We normally begin with a short survey of the sites and equipment concerned, followed by a proposal. A typical site can be connected within ten working days of the connector arriving on site. Call us on 0113 496 0827 or send us an enquiry.