Skip to content

Security Information Report

This report describes the security posture of the MultiTaction Base Linux Image for current Hydra appliances (H2, H4, H8, H12, H16). It is written for customers and site security reviewers evaluating the platform, and covers the platform's design intent rather than implementation detail.

Engineering preview. This report describes the target security posture of the Ubuntu 24.04 rewrite. Current builds are engineering previews and have not completed hardware or security qualification. Contact MultiTaction support before relying on any preview build for a production deployment.

Boot integrity

  • Secure Boot is mandatory for a formally supported installation, and when enabled, the appliance verifies its boot chain and kernel modules against a trusted signing authority at every boot. The platform is not designed to require Secure Boot to install or run — disabling it is a supported hardware configuration in some environments, but takes the deployment outside MultiTaction's qualification and support boundary.
  • The Installer USB and the Base Image it carries are cryptographically signed. The installer verifies both the signature and the content integrity of the image before it will expose any destructive installation action — a corrupted or tampered image is refused, not silently accepted.
  • Release media is built only by MultiTaction's CI pipeline from traceable source. Each release carries signatures, checksums, a package/version manifest, and a software bill of materials, so support can identify exactly what a given appliance is running.

What ships on the image

The Base Image is a sealed, reproducible image. Sealing is a deliberate step that removes machine-specific and secret state — device identity, runtime credentials, certificates, and any customer data — from the image before it is captured for distribution. Every appliance installed from the same release starts from an identical, machine-generic image; nothing about one customer's deployment is present in another customer's install media.

Device identity is not baked into the image. Each appliance derives its own identity on first boot, so no two appliances share identifying material. On hardware with a usable TPM 2.0 device, this identity is derived deterministically from the TPM, so a complete disk wipe and reinstall reproduces the same identity rather than orphaning the appliance's remote-support history. TPM 2.0 is not required to install or run the appliance: on hardware without one, first boot instead generates a random software identity and the appliance shows a local warning that its remote-support identity is not hardware-anchored, since that identity does not survive a subsequent Factory Reset.

Local administration

The customer owns the unrestricted local administrator credential on every appliance. MultiTaction does not hold, escrow, or distribute a shared password for customer systems. Routine, in-scope configuration and MultiTaction-approved software installation are available to the normal appliance account through narrowly scoped controls — that account cannot install arbitrary software or make unrelated system changes.

Remote support access

MultiTaction remote support does not use a shared credential. Each appliance can register itself as a remote-support destination using a capability that permits registration only — it grants no access to operate the appliance and no access to any other node. Actual support access is separately authenticated, individually authorised, and centrally audited through role-based access control, so every remote support session is attributable to a specific, authorised support engineer.

Remote support enrollment is enabled by default so a newly connected appliance is remotely supportable without extra customer action, and can be disabled locally by the customer at any time. Disabling it removes MultiTaction's ability to reach that appliance remotely.

Network posture

The appliance separates customer-network traffic from wall/touch-device traffic into two distinct network roles, and does not route or bridge between them until a technician explicitly configures that. This means connecting the appliance to two networks at once does not, by itself, create a path between them. All interfaces use DHCP by default, and the wall-facing network is restricted to a wired, IPv4-only connection.

Data protection

Customer and application data lives on a filesystem that is logically separate from the operating system. This separation is what allows a supported repair to replace the operating system without touching that data, and it means a defect or reinstallation on the system side does not by itself put customer data at risk. Storage encryption is available as a deployment option for sites that require it; it is not enabled by default, to avoid imposing unattended-unlock complexity on every deployment.

Update and patch management

Ubuntu security updates are installed automatically, so appliances receive routine operating-system security fixes without waiting on a manual step. Changes with higher operational risk — kernel and graphics driver updates, optional driver changes, and MultiTaction application updates — are applied only through a controlled, qualified path, and the appliance never reboots on its own to apply anything. Appliances are configured to a single stable release channel; reaching an unqualified build requires a deliberate, manual choice.

Telemetry and privacy

The appliance does not run additional operating-system health or usage telemetry beyond the crash reporting already built into each installed MultiTaction application. Support diagnostics are opt-in and produced on request: a single sanitised support bundle containing hardware, configuration, and version information, service status, and bounded logs — explicitly excluding secrets, credentials, customer file names, and application databases.

Licensing and third-party components

The image follows an LGPL-only media codec policy and links the Qt framework dynamically, consistent with MultiTaction's open-source licensing obligations. A full package manifest and software bill of materials are produced for every release.

Reporting a security concern

If you believe you have found a security issue affecting a MultiTaction appliance or this image, contact MultiTaction support through your normal support channel and describe the issue. Do not include customer data, credentials, or exploit details in an unencrypted message — support will provide a secure channel for further detail if needed.