Architecture
dash.retivo.net, the Retivo Node, and what is stored where.
Retivo is split in two so that your device credentials and configs never have to leave your network.
your browser ──HTTPS──▶ dash.retivo.net ◀──outbound WSS── Retivo Node ──SSH / SNMP──▶ your devices
(accounts, license) (inside your network)
dash.retivo.net
The service you sign in to. It holds:
- your company and its users,
- how each user signs in (Retivo password with an email code, Microsoft Entra ID or Active Directory),
- the license and the enrollment token,
- which nodes are enrolled, when they were last seen, their version and how many devices they manage.
Retivo Node
A Docker container on a server in your network. It holds:
- the device inventory and groups,
- credentials (SSH, SNMP, API tokens, backup destinations), encrypted with a key that never leaves the node,
- every config version, push and restore,
- vulnerability, lifecycle and health data,
- the audit log of what happened on the node.
The node opens one encrypted outbound connection to dash.retivo.net and keeps it open. It never accepts connections from the internet, so there is no port to open, no NAT rule and no VPN.
What travels over the connection
| From the node to dash | From dash to the node |
|---|---|
| A heartbeat with the node's version and device count | The license (plan, device limit, status) |
| Answers to requests you make in the browser | Requests you make in the browser |
| The result of an Active Directory password check | An Active Directory password to check, when someone signs in that way |
Note
Configs and credentials are read on the node. When you open a page that shows them, the page is relayed to your browser and not stored on dash.retivo.net.
Several nodes
A company can enroll more than one node, for example one per site. Each node manages the devices it can reach. All of them appear on your overview with their status.
What's next
Last modified October 15, 2026