Secure Connectivity
Managed from the Cloud, No Inbound Ports
Once an appliance is paired, it opens an outbound connection to ShadowCradle Cloud. You do not need an inbound firewall rule for cloud management. An appliance that is not paired, or runs the Airgap tier, opens no cloud connection.
Outbound only
Token authenticated
Remote shell off by default
Approved support sessions
Airgap: no connection
How the Connection Works
Outbound WebSocket
After pairing, the appliance opens a WebSocket to the cloud. The cloud never connects in.
Token authenticated
The appliance proves who it is with its pairing token.
Your login still applies
The cloud only relays. The appliance checks its own roles and permissions for each request.
Remote shell is off
The remote shell is blocked through the relay unless the operator turns it on.
Management only
Backup data does not travel through this connection. Agents back up to the appliance directly. Replication between appliances is direct too.
Airgap and unpaired
An unpaired or Airgap appliance opens no cloud connection. It works fully without it.
Support Sessions Need Your Approval
Remote support rides the same connection. It is time-boxed and audited.
Approved by your org
Takelan support requests access. An owner or admin of your organization must approve it. Platform admins cannot approve their own access.
Time-boxed
A session lasts 60 minutes by default and at most 4 hours. An unanswered request stays open for up to 24 hours, then lapses.
Unattended consent
You can give ticket-scoped consent for unattended work. It lasts at most 72 hours and you can revoke it.
One org, one device
A session covers one organization and one device. Risky actions, such as destroying data, are blocked for support.
You can ban access
Block support access for a device, an engineer or your whole organization.
Audited
Support sessions and their actions are recorded in an audit log.
Good to Know
The cloud sees relayed calls
The cloud relays your appliance web API calls, so it can see that traffic. The link is encrypted with TLS, but it is not end-to-end encrypted.
Optional Takelan services
Takelan platform services are a separate, optional link. See Platform Benefits.
Part of the Full ShadowCradle Platform
Data loss stops here
Write-once retention and self-healing storage engineered to make data loss the exception, not the outcome.
Backups that test themselves
Scheduled restore tests - recovery you've watched work.
Audit-ready by default
Reports to support HIPAA · SOC 2 · GDPR work, from the dashboard. Not a certification.
A team behind every deployment
Real engineers on the line, with fast follow-up.