Security, Data Privacy & Compliance

Every machine is provisioned with a unique, single-use secret. No default credentials, no shared keys. Access is granted only to organization members.

Each machine uses its unique machine secret to establish an outbound, encrypted connection to app.viam.com. Remote management with no inbound firewall rules required.

Within a LAN, machines use location certificates to establish mTLS connections for high-speed, secure local coordination. Across the internet, machines negotiate a peer-to-peer WebRTC tunnel. Data flows directly between machines, not through Viam's servers.

Your application code connects to hardware through the same encrypted layer no matter where it’s running from. No open ports, no port forwarding, no firewall configuration required. NAT traversal is handled automatically. Same mechanism, same guarantees, regardless of where you're connecting from.

Viam secures end-customer access to your machines—from industrial fleets to consumer devices—through a managed OAuth2 layer with native SSO support. This removes the burden of building a bespoke authentication stack or managing static credentials for every unit shipped. A standard login flow provides enterprise-grade identity and granular access control that remains consistent as you scale.

Updates (code, ML models, and configuration) are versioned and deployed through the Viam Registry. Pin to stable versions, roll out to a subset of machines first, and roll back with a single change if something goes wrong. No SSH loops. No per-machine intervention.

Viam is local-first. The viam-server binary handles all control loops, hardware drivers, and logic locally. It caches its JSON configuration on the device; if the cloud connection is severed, your machine continues to operate according to its last known state. Once connectivity is restored, any queued telemetry or data logs are synced to the cloud automatically.

Viam uses a P2P architecture (gRPC over WebRTC) where the machine initiates an outbound connection to a signaling server. This allows for secure remote control and data streaming through NATs and firewalls without requiring a public IP, port forwarding, or a VPN. For highly restrictive enterprise environments, Viam supports STUN/TURN relay fallbacks to ensure a reliable connection.

Each module runs as its own independent process, communicating with the core server over local Unix Domain Sockets (UDS) using gRPC.This sandboxing ensures that a failure in one module (e.g., a camera driver) doesn't crash the entire machine. You can pin your fleet to specific semantic versions to control your software release management plan.

The viam-agent manages the lifecycle of the server and its dependencies. You can define maintenance windows to ensure updates only occur during scheduled downtime, and roll out changes to a canary subset of your fleet before a global deployment.