Security & Access Control
- Table of Contents
- What access restrictions are available for the GreenArrow platform?
- What access does GreenArrow require for support/maintenance?
What access restrictions are available for the GreenArrow platform?
Access restrictions can be applied at several different levels.
Users
User accounts can be restricted in what they can do on the platform, both in the configuration file and through the Engine UI
Two-Factor Authentication
GreenArrow supports two-factor authentication with the Time-based one-time password algorithm.
Source IP
Access to the UI and API can be limited by IP address, using the allow_ui_api_access configuration directive.
Firewall
GreenArrow can be placed behind a firewall.
Some of GreenArrow’s features require incoming access from the public internet, such as HTTP access for click/open tracking (if you are using that) and incoming SMTP access to accept incoming asynchronous bounce email messages.
We provide documentation regarding what firewall ports need to be open for access to given services.
Some customers setup a separate GreenArrow cluster to process incoming asynchronous bounces and handle click/open redirection, apart from a cluster of outgoing MTAs. This allows the outgoing MTAs to be completely isolated behind a firewall.
HTTP/HTTPS Filtering
If you are using GreenArrow for click/open tracking, you can use a reverse HTTP/HTTPS proxy to isolate GreenArrow from the Internet.
This document describes what URIs need to be exposed for engagement tracking to work (if you’re using that feature in GreenArrow).
What access does GreenArrow require for support/maintenance?
If you are an on-premises customer, we do not require any access to your systems; however, it can make it easier for our support team to assist you with troubleshooting complex issues if we have access to your server.
We have a few options for opening access, including direct SSH access, hopping through a reverse SSH tunnel, or using VPN access you provide to us. It also can be helpful for us to have login access to your Engine and Studio UIs, if appropriate. That said, we have supported major customers without any direct access to their systems.