The Netop Portal. Hosted in your environment.
Run controlled, auditable remote operations within your own infrastructure, with full control over deployment, data, and access.
What happens when the cloud simply isn’t an option?
For OT, air-gapped, regulated, and highly controlled environments, secure remote access still needs to work — without giving up control of your infrastructure.
Join us for a live webinar introducing the Netop Self-Hosted Portal and see how you can keep remote access within your own environment while centrally managing users, devices, and connections.
In this webinar, we’ll show you how to:
- Keep identities, keys, logs, and audit trails inside your own boundary
- Enable authenticated, time-bound, fully logged remote support sessions
- Securely manage multiple customers, sites, or business units with multitenancy
- Maintain visibility and control across security-sensitive environments
Choose the session that works best for you.
Can’t join live? Register anyway and we’ll send you the recording.
Register for a session
Where traditional remote access falls short
Most remote access solutions are built for convenience, not sovereignty. For organizations operating in classified, air-gapped, or restricted environments, this creates a structural gap that standard workarounds cannot close.
Legacy Infrastructure
Jump boxes, bastion hosts, and legacy remote-access appliances predate modern Zero Trust. They often lack the granular controls, visibility, and auditability required under CMMC, NIST 800-171, and IEC 62443.
VPN and third-party access
Extending VPN credentials to third-party vendors can create persistent access, overprivileged accounts, and audit findings that resurface during penetration tests and compliance reviews.
On-site intervention
When remote access cannot meet classification or security requirements, organizations are forced back to physical site visits, adding cost and days of delay across distributed environments.
Netop Self-Hosted Portal: Sovereign by Architecture
The Self-Hosted Portal is designed for defense and government agencies, critical infrastructure operators, and regulated enterprises where vendor-hosted SaaS platforms and cloud-dependent tooling create structural conflicts with classification requirements, compliance mandates, or operational security policy.
Deployed entirely on-premise or within a private cloud. No external dependencies: operational in classified, air-gapped, and sovereignty-restricted environments without modification or exception.
Customer-owned certificates, keys, and storage. Full local audit retention. No data leaves the infrastructure boundary under any condition.
Fully containerized and infrastructure-agnostic across compute, storage, identity, and networking. Portable without redesign. Consistent security posture, whether deployed on-premise, in a private cloud, or within AWS European Sovereign Cloud and Microsoft Cloud for Sovereignty. The deployment model conforms to organizational requirements — not the other way around
Security is enforced at the architectural level, not bolted on as a compliance layer after the fact. No inbound ports. No IP exposure. Granular access controls and least-privilege enforcement are built into the platform from the ground up, with full auditability at every layer.
Specific use cases include organizations subject to CMMC, NIST 800-171, CJIS, or HIPAA, where data residency and infrastructure control are non-negotiable; environments where VPN-based third-party access creates unacceptable audit exposure; and distributed operations where on-site vendor visits are costly and time-consuming.
How the Self-Hosted Portal Works
One Portal experience. A different operating model.
Self-Hosted Portal brings the Netop Portal into customer-controlled infrastructure. The Portal experience, endpoint workflows, access model, and Netop remote-access ecosystem remain consistent. What changes is where the Portal runs, how the supporting infrastructure is managed, and where operational data is retained.
What stays consistent
- Netop Portal experience
- Device inventory and endpoint management
- Secure remote-access workflows
- User, group, and access controls
- Netop Host, Guest, and OnDemand
What changes
- The Portal runs within customer-controlled infrastructure
- The customer controls the hosting environment
- Infrastructure and network access remain under customer control
- Identity, certificates, keys, logs, and operational data remain inside the customer environment
- Runtime does not rely on Netop's shared cloud environment
Security-by-Design for Regulated Environments
Zero-Trust by Architecture
No inbound ports. No IP exposure. Security enforced at the architectural level, not added as a compliance overlay. Identity bound at the portal layer, with granular access control and full audit retention under your infrastructure.
Multi-Tenant Support
Unlimited tenants supporting large-scale organisational structures and multi-entity deployments.
Hierarchy-Based Access Control
Least-privilege enforcement with role-based controls mapped to organisational structure and clearance requirements.
Compliance Alignment
Architected to support SOC 2, PCI DSS, CJIS, HIPAA, CMMC, and NIST 800-171 requirements.
Frequently Asked Questions (FAQs)
What is the Netop Self-Hosted Portal?
Netop Self-Hosted Portal brings the Netop Portal experience into your own controlled infrastructure. It provides centralized remote access and management while allowing your organization to maintain control over deployment, infrastructure, data, and network access.
Who is the Self-Hosted Portal designed for?
The Self-Hosted Portal is designed for organizations that need greater control over their remote access infrastructure. This includes regulated enterprises, critical infrastructure operators, defense and public sector organizations, and environments with strict security, data residency, or network requirements.
What is the difference between the Self-Hosted Portal and the Netop SaaS Portal?
The primary difference is where the Portal is hosted and who controls the infrastructure. Self-Hosted Portal is deployed within your organization's environment, while the SaaS Portal is hosted and managed by Netop. Self-Hosted Portal is best suited to organizations that require greater infrastructure control or operate in restricted environments.
Where can the Self-Hosted Portal be deployed, and where does it require Linux?
Self-Hosted Portal can be installed in a Docker environment and does not require Linux specifically. It can be deployed within customer-controlled infrastructure, including on-premises, private cloud, public cloud, or other Docker-based environments.
Can the Self-Hosted Portal operate in restricted or air-gapped environments?
The Self-Hosted Portal is designed for restricted environments where normal operation cannot depend on external internet connectivity. It supports air-gapped operation after installation for organizations with strict network isolation requirements.
Does the Self-Hosted Portal require inbound firewall ports?
The Self-Hosted Portal is designed to use outbound connectivity from managed endpoints, helping organizations avoid exposing systems through inbound firewall ports.
How are users added and managed in the Self-Hosted Portal?
Users can be invited directly from the Portal by entering one or more email addresses. Self-Hosted Portal does not currently support CSV user imports, but administrators can paste a list of email addresses when sending invitations.
User creation can also be streamlined through identity integrations. For example, LDAP users can be added automatically on first login, and Azure AD group membership can be used to manage access.
Does the Self-Hosted Portal support multitenancy, and how are tenants managed?
Yes. Self-Hosted Portal supports multitenancy.
Administrators can create and manage separate Portal accounts or tenants. Each tenant maintains its own users, devices, access controls, permissions, and session history. A technician can also belong to multiple Portal accounts and switch between them while keeping permissions and settings separate.
Each tenant is administered independently rather than through a single bulk-management console.
Which identity providers does the Self-Hosted Portal support?
Self-Hosted Portal supports enterprise identity integrations including ADFS, LDAP, and Microsoft Entra ID.
How does the Self-Hosted Portal control internal and third-party remote access?
The Self-Hosted Portal provides centralized access controls that allow organizations to define which users can access specific devices, systems, or groups. This can also be used to provide vendors and contractors with access limited to the systems they are authorized to support.
Role-based permissions, authentication controls, session governance, and auditability help organizations maintain oversight of both internal and third-party access.
How are user activity and audit logs monitored or exported?
The Self-Hosted Portal provides audit logs covering user activity such as sign-ins, user and role changes, account configuration, remote control sessions, and file transfers.
Administrators can generate CSV reports from Security > Logs for a selected date range. The standard Portal does not currently provide a public REST API for automatically retrieving audit logs or access-violation events. Customers requiring automated or SIEM-style integrations should discuss their requirements with Netop.
Does the Self-Hosted Portal provide centralized device management?
Yes. The Self-Hosted Portal provides a centralized view of enrolled devices. Authorized users can search for and access the devices they are permitted to manage without needing to know individual IP addresses.
Can the Self-Hosted Portal manage or recover devices when the operating system is unavailable?
Yes, for supported Intel vPro and Intel AMT-enabled devices. Netop can extend remote management below the operating system, providing capabilities such as BIOS-level access, remote power management, troubleshooting, and recovery when normal OS-level remote access is unavailable.
Does the Self-Hosted Portal support MFA (Multi-Factor Authentication)
Yes, the Self-Hosted Portal supports multi-factor authentication (MFA). Currently, email-based authentication is available as the supported MFA method. Users receive a verification code by email, which provides an additional layer of security.
