Architecture overview
WXP is a cloud-based platform that collects and analyzes device telemetry across supported operating systems, provides reporting and device management capabilities, and integrates with third-party services.
Security controls are applied across the WXP platform and its supporting services to protect devices, data, users, and communications.
Users and Roles
WXP dashboard uses role-based permissions to control access to features and customer data. As shown on the diagram:
WXP has the following roles:
Roles | Scope |
|---|---|
Root Admin | Used by HP business operations administrator to create new tenants for both direct customers and partners. Regional root administrator accounts are controlled and have access to manage and navigate direct customer and partner tenants. Typically, separate root admin accounts exist for each region. Currently, WXP operates in three AWS regional data centers (see WXP Platform for more information). |
HP Support | Can access multiple companies simultaneously and manage devices, users, and day-to-day operations on behalf of customers for troubleshooting purposes. These actions are managed by HP’s Business Operations team. There are two types of users under an HP Support account:
|
Partner | Partner tenants may include partner admin, service specialist, and sales specialist roles. These tenants can access multiple customer accounts and manage devices, users, and daily operations on their behalf.
|
Primary IT Admin | The first IT administrator to registers a company tenant when a company is created becomes the Primary IT Admin. Can manage users, handle device-related tasks, access reports, and other administrative functions based on their permissions. While Partners manage users across multiple companies, Primary IT Admins independently manage users within their own company. |
Company User | An individual within an enterprise company tenant who is assigned a role that allows them to take actions. Can be created in the following ways:
|
IT Admin | The IT Admin role is assigned to users within customer or self-managed companies. It allows users to perform key administrative tasks such as managing users and devices. While similar in function to roles available to partners, IT Admin access is limited to their own company. |
Report Admin | By default, the Primary IT admin has access to reports. Any company user can also be granted report access. The Report Admin role is read-only and allows users to view information from WXP reports. |
Connector Admin | This role enables secure, role-based management of integrations within WXP. This role governs access to integration actions across all supported connector. It ensures only authorized users can configure and manage integration widgets and connection settings. Connector Admins can perform the following actions within WXP:
|
The following diagram provides a high-level overview of the Insights functionality and capabilities:
WXP Devices
WXP uses device enrollment and authentication mechanisms to prevent attackers from gaining control of devices. To add devices, your company’s IT administrator or Partner must use an assigned Company PIN.
Note: Depending on hardware and operating systems, device software must be installed during the provisioning process.
The enrollment process performs an asymmetric key exchange between the device and WXP server. Each device receives an access token that is valid for 12 hours. After this period, the device must re-authenticate sending signatures to the server to prove their identity before receiving a new access token.
With enterprise consent, enrolled devices upload telemetry data daily to WXP analytics pipeline. Devices can also receive supported commands and control signals from WXP, these communications are authenticated using the device access token.
WXP for Microsoft Windows® uses the HTTPS/TLS 1.2 protocol over port 443 for all communications and it does not install certificates or modify the Windows Operating System Certificate Store.
WXP Platform
WXP is hosted in Amazon Web Services (AWS) across regional environments:
United States: AWS Oregon (US West-2)
European Union: AWS Germany (EU Central-1)
Australia: AWS Asia Pacific, Sydney Region (AP Southeast-2)
Customer tenants are provisioned in the applicable regional environment based on the customer’s registration.
IT administrators access WXP through a web browser for device enrollment, authentication, management and reporting.
The WXP platform applies security controls at the identity, session, authorization, application, data, and infrastructure layers. The next sections cover the technical controls implemented at each layer.
Identity Management
Currently, the supported identity providers (IdPs) are:
Identity Provider | Password policy |
|---|---|
HP Common Identity System (HPID) | Set by HP ID Signup Page. At least eight characters and three or more of the following:
|
Microsoft Entra ID | Set by customer’s administrator. May include multi-factor authentication and password complexity requirements. |
Session Management
While WXP does not limit the number of concurrent sessions, user sessions automatically expire after 30 minutes of inactivity, device sessions expire every 12 hours and are renewed automatically.
WXP uses OAuth 2.0 for authentication and authorization and JSON Web Tokens (JWT) for session management. Each WXP microservice enforces JWT verification for signature validity and token expiration.
Authorization
WXP uses role-based authorization to control access to platform resources.
For requests to protected services, WXP validates the user’s authentication token and verifies the associated tenant and permissions. Access is granted only when the request satisfies the required authentication, tenant, and role checks.
Multi-tenancy
WXP uses logical tenant separation to isolate customer data and resources.
Each tenant is identified by a unique identifier (UUID). WXP uses tenant entitlement checks to ensure that requests can access only resources associated with the authorized tenant.
Tenant isolation is enforced across WXP services to prevent unauthorized access to data belonging to another tenant.
Data-At-Rest
Company information, including device, user, and related data, is stored in AWS Relational Database Service (RDS) for MySQL and MongoDB.
Both data stores are encrypted at rest. Sensitive fields, such as keys and tokens, are also encrypted using AWS Key management Service (AWS KMS).
The master key is rotated according to HP Cybersecurity Guidelines.
Data-in-Transit
All external communication to and from WXP uses the HTTPS with TLS 1.2.
Internal service-to-service traffic runs within an isolated AWS Virtual Private Cloud (VPC).
Network segmentation, security groups, and access control lists (ACLs) restrict and control traffic between services.
Third-Party Integration
WXP integrates with various third-party services such as:
ServiceNow
Power BI
Tableau
Microsoft EntraID
Server-to-server communication with these services uses HTTPS and authentication methods provided by our partners’ systems.
User Interfacte (UI) validation
WXP validates input fields in the WXP Agent based on expected data types and applicable business rules. Validation can include:
Data type validation, such as string, date/time, and currency.
Business rules, such as required and recommended field validation.
Role-based access controls that define if a user can read or modify a field
Additional validation can be applied through scripting functions.
WXP Analytics Platform
The WXP Analytics Platform provides the infrastructure used to ingest, process, analyze, and store telemetry and analytics data collected from WXP devices.
The platform is hosted on AWS and uses an authenticated API Gateway for secure, one-way data ingestion from devices.
Analytics data is stored in AWS services, including Amazon S3 for unstructured data and Amazon Redshift for structured data, with both data types encrypted at rest in accordance with WXP security requirements.
Artificial Intelligence and Machine Learning in WXP
WXP integrates Artificial Intelligence (AI) and Machine Learning (ML) to support proactive insights, predictive analytics, device and user experience optimization.
WXP AI and ML capabilities include:
Predictive device health and proactive remediation
Sentiment and pulse analysis
Hardware and software usage-based device recommendations
Generative AI for data interaction and reporting
Anomaly detection and failure prediction
AWS infrastructure
WXP is hoted on Amazon Web Service (AWS) across regional environments in the United States, European Union, and Australia.
WXP uses AWS infrastructure to provide compute, storage, and network services. Security controls include encryption, network segmentation. access controls, and infrastructure resilience.
AWS provides physical and environmental security for its data centers and maintains controls designed to protect customer data and support service availability.
Network security
WXP uses firewalls and other boundary devices to monitor and control communications at external and internal network boundaries.
Access control lists (ACLs) and network rules control traffic between network interfaces and services. WXP also uses controlled API endpoints to secure communication with AWS services.
Internet-facing network connections use redundant communication services to support availability.
Application, host, and administrator security
WXP applies security controls at the application, host, and administrative access layers.
Access to WXP and customer data is limited to personnel who require it to perform their assigned responsibilities. Access is managed through appropriate account controls and background checks.
Remote Connect
Remote Connect provides In-Band and Out-of-Band access to managed devices for troubleshooting and device recovery. The feature is available in all WXP-supported regions.
Note: Regional data sovereignty for Remote Connect is not supported at this time.
In-Band Remote Connect is disabled by default and must be enabled for the tenant. Only authorized WXP roles can initiate a remote support session. A session requires end-user consent and validation of a session code.
Remote Connect establishes sessions over HTTPS using TLS 1.2 or later. During session setup, HP cloud infrastructure authenticates and authorizes the session through U.S.-based endpoints. After the session is established, remote session traffic flows through a shared WXP Remote Connect gateway and remains end-to-end encrypted using AES-256. The gateway does not decrypt, inspect, or store remote session content.
Gateways are distributed globally to support availability and performance. When a gateway is available in the same region as the managed device, session traffic can remain within that region after session establishment.
Note: For additional information, refer to the article Security FAQ - In-Band.
Related Resources
For more information about WXP security, see: