Data sent
A Nexus Telemetry Fleet collector reads measurements from the Starlink terminal at its site and sends them to the fleet server. It sends measurements. Two actions reach the terminal, a speed test and a reboot, both started by a user from the dashboard. The connection is opened by the collector, from the site out to the fleet server. This page lists what is sent, what never leaves the site, and how long the fleet server keeps it.
Data that leaves the site
The collector sends 4 kinds of reading.
| Kind | Contains |
|---|---|
| The terminal | Download and upload rates, latency, obstruction, outage counts, service state, alerts, signal and thermal figures, hardware and software versions, and the position the terminal reports |
| The connection | Whether it is healthy, whether the site is on the backup connection, round trip time, loss, the active network interface and gateway, the site’s public address, and which internet provider that address belongs to |
| Reachability | Whether the terminal, the site’s router, 2 public resolvers and the addresses set under Connectivity checks on the dashboard could be reached from the site, the best and average times, and the loss |
| The collector | Its hostname, version and uptime, and the load, memory and disk of its host |
Frequency
The collector takes a reading every 30 seconds by default, the interval the fleet server gives it at enrolment. Every 30 seconds it sends the current value of each reading. Each 5-minute period’s summary is sent once, when the period ends. Once a day it sends the terminal’s sky map. A change of state is sent immediately. While a user has the terminal’s Live view open, the fleet server asks the collector for readings up to once a second, and stops asking when the view closes.
Data that never leaves the site
The collector sends no user traffic. It measures the connection and never captures, proxies or forwards what goes over it. It keeps no list of who or what is on the site’s network. The collector’s log stays on the host, as 5 rolling files of 10 MB, to be read there or attached to a support message by hand.
Connection
The collector opens one connection to the fleet server, on port 9443 by default. It is a TLS connection in which both ends present a certificate, and the readings go over it as compressed protocol buffers over HTTP/2. Everything the fleet server sends to the collector, commands included, goes over the same connection. Nothing connects into the site, and the collector opens no port to the internet.
Position
The collector sends the terminal’s position with the readings, and the dashboard’s Map places the site from it. On the Admin view of the terminal’s page the position can be set to fixed coordinates, taken from another GPS source, or turned off. See Collector GPS.
A position is never written to a log. Nexus Telemetry’s own tests fail if a
position, a token, a licence key, a credential or a private key appears in
any log, at any log level. The support bundle written by diagnose follows
the same rule.
By default the collector asks a public lookup service which internet provider
the site’s public address belongs to, so that address goes to a third party
as well as to the fleet server. The collector setting NF_CONNECTION_ASN_MODE=off
stops that lookup.
Retention
The fleet server keeps 5-minute summaries, and the readings sent in full around a change of state. Summaries then roll up to hourly, then daily. Daily summaries are kept forever. The periods on the fleet server are below. The collector keeps the same tiers, for its own use.
| On the fleet server | Kept for |
|---|---|
| Readings sent in full, around a change of state | 7 days |
| Five-minute summaries | 90 days. The percentiles inside a summary are dropped after 30 days, and the averages kept for the 90 |
| Hourly summaries | 2 years |
| Daily summaries | Forever |
| Audit entries | 90 days |
The 4 periods that are not forever are set on the Settings page. See Server configuration. A collector that cannot reach the fleet server keeps its readings, however old, until the fleet server confirms it has received them.
Encryption at rest and in transit
The fleet server’s data is stored on an encrypted disk. Every connection between a collector and the fleet server is TLS. See Backup and restore.
Dashboard analytics
A customer’s dashboard loads no analytics and calls no third party from the browser. The public demo at demo.nexustelemetry.net is the one exception. It counts page views with Plausible on Nexus Telemetry’s own domain, with no cookies and no personal data.
Usage analytics for managed fleet servers are planned: page counts, the features used, and platform health. They will hold no personal data. A self-hosted fleet server will send nothing.
Data location
On a managed fleet server, an organisation’s data is in its own database on the provider’s host. On a self-hosted fleet server, it is in the fleet server’s data directory and nowhere else.
Deleting a terminal’s data
A terminal’s readings, summaries, sky maps and event history are all deleted when its collector’s record is removed. The reports lose its history with it. The collector is decommissioned or revoked first, then removed with Remove on the Admin view of the terminal’s page. The certificate audit log and the deny list entry are kept, so a revoked certificate can never be used again. See Retire and revoke.