Data sent
A Nexus Telemetry Fleet collector reads measurements from the Starlink terminal at its site and sends them to the fleet server. It sends measurements. Two actions reach the terminal, a speed test and a reboot, both started by a user from the dashboard. The connection is opened by the collector, from the site out to the fleet server. This page lists what is sent, what never leaves the site, and how long the fleet server keeps it.
Data that leaves the site
The collector sends 4 kinds of reading.
| Kind | Contains |
|---|---|
| The terminal | Download and upload rates, latency, obstruction, outage counts, service state, alerts, signal and thermal figures, hardware and software versions, and the position the terminal reports |
| The connection | Whether it is healthy, whether the site is on the backup connection, round trip time, loss, the active network interface and gateway, the site’s public address, and which internet provider that address belongs to |
| Reachability | Whether the terminal, the site’s router, 2 public resolvers and the addresses set under Connectivity checks on the dashboard could be reached from the site, the best and average times, and the loss |
| The collector | Its hostname, version and uptime, and the load, memory and disk of its host |
Frequency
The collector takes a reading every 30 seconds by default, the interval the fleet server gives it at enrolment. Every 30 seconds it sends the current value of each reading. Each 5-minute period’s summary is sent once, when the period ends. Once a day it sends the terminal’s sky map. A change of state is sent immediately. While a user has the terminal’s Live view open, the fleet server asks the collector for readings up to once a second, and stops asking when the view closes. When the view opens, the collector sends its last 15 minutes of readings at one a second. For the hour, 6-hour and day charts, the fleet server asks for that window of the terminal’s one-second readings, as the average, minimum and maximum of each interval, and asks again once a minute while the chart is open. The fleet server keeps those answers in memory only.
On the managed service, the collector asks the provider’s directory which fleet server holds its organisation when it starts, and again after its certificate is refused, after a fleet server answers that the organisation has moved, and after its fleet server has not answered 3 attempts in a row. The request holds the organisation’s id and nothing else. A collector whose certificate is refused 3 times over at least 10 minutes stops sending readings and connects once an hour.
Data that never leaves the site
The collector sends no user traffic. It measures the connection and never captures, proxies or forwards what goes over it. It keeps no list of who or what is on the site’s network. The collector’s log stays on the host, as 5 rolling files of 10 MB, to be read there or attached to a support message by hand.
Connection
The collector opens one connection to the fleet server, on port 9443 by default. It is a TLS connection in which both ends present a certificate, and the readings go over it as compressed protocol buffers over HTTP/2. Everything the fleet server sends to the collector, commands included, goes over the same connection. Nothing connects into the site, and the collector opens no port to the internet.
Position
The collector sends the terminal’s position with the readings, and the dashboard’s Map places the site from it. On the Admin view of the terminal’s page the position can be set to fixed coordinates, taken from another GPS source, or turned off. See Collector GPS.
A position is never written to a log. Nexus Telemetry’s own tests fail if a
position, a token, a licence key, a credential or a private key appears in
any log, at any log level. The support bundle written by diagnose follows
the same rule.
The collector learns the site’s public address from cloudflare.com, or from
api.ipify.org when that fails. By default it asks ipinfo.io which internet
provider that address belongs to, so the address goes to these services as
well as to the fleet server. The collector setting NF_CONNECTION_ASN_MODE=off
stops the provider lookup. NF_CONNECTION_IP_URLS and NF_CONNECTION_ASN_URLS
replace the services.
On an update, a macOS or Windows collector downloads the release manifest and
the installer from the download host itself. With NF_WEATHER on, the fleet
server sends each terminal’s position, rounded to 0.1 degrees, to the weather
service.
Retention
The fleet server keeps 5-minute summaries, and the readings sent in full around a change of state. Summaries then roll up to hourly, then daily. Daily summaries are kept forever. The periods on the fleet server are below. The collector keeps the same tiers, for its own use, and 7 days of the terminal’s one-second readings.
| On the fleet server | Kept for |
|---|---|
| Readings sent in full, around a change of state | 7 days |
| Five-minute summaries | 90 days. The percentiles inside a summary are dropped after 30 days, and the averages kept for the 90 |
| Hourly summaries | 2 years |
| Daily summaries | Forever |
| Audit entries | 90 days |
The 4 periods that are not forever are set on the Settings page. See Private deployment. A collector that cannot reach the fleet server keeps its readings, however old, until the fleet server confirms it has received them.
Encryption at rest and in transit
The fleet server stores its databases and keys as plain files, readable by its own account only. Encryption at rest is the encryption of the host’s disk. Every connection between a collector and the fleet server is TLS 1.3. The fleet server keeps the address of a host whose certificate it refused, in memory, for 24 hours.
Dashboard analytics
A customer’s dashboard loads no analytics and calls no third party from the browser. The public demo at demo.nexustelemetry.net is the one exception. It counts page views with Plausible on Nexus Telemetry’s own domain, with no cookies and no personal data.
Usage analytics for managed fleet servers are planned: page counts, the features used, and platform health. They will hold no personal data. A fleet server in a private deployment will send nothing.
Data location
On a managed fleet server, an organisation’s data is in its own database on the provider’s host. In a private deployment, it is in the fleet server’s data directory and nowhere else.
Deleting a terminal’s data
A terminal’s readings, summaries, sky maps and event history are all deleted when its collector’s record is removed. The reports lose its history with it. The collector is decommissioned or revoked first, then removed with Remove on the Admin view of the terminal’s page. The certificate audit log and the deny list entry are kept, so a revoked certificate can never be used again. See Retire and revoke.