SC//Fleet™ Manager is the edge orchestration service that helps you monitor and manage clusters running SC//HyperCore™ HyperVisor across many sites from a single console. It is a cloud service that touches every cluster you link to it. So its security model is designed to keep each cluster in control of its own fate while you work at fleet scale.
For what SC//Fleet Manager actually does day-to-day — registration, dashboards, Secure Link, updates — see SC//Fleet Manager.
Outbound-only, two-way SSL communication
Communication between an SC//HyperCore cluster and SC//Fleet Manager is cluster-initiated and outbound only. Clusters open two-way SSL connections over port 443 (TLS and MQTT) to api.scalecomputing.com and broker.scalecomputing.com. This has some key results:
- You don’t need to open inbound firewall ports or publish clusters to the internet for SC//Fleet Manager to manage them.
- SC//Fleet Manager cannot start a connection to a cluster on its own. The cluster decides when to connect.
- Data exchanged between the cluster and SC//Fleet Manager is accessible only to customer-authorized SC//Fleet Manager users and to designated Scale Computing Support staff.
Just as important, SC//Fleet Manager communication is not required for the SC//HyperCore cluster to function or to take self-corrective action. If the link to SC//Fleet Manager is lost, clusters keep running, healing themselves, and serving workloads just as they did before. Access to the cluster cannot be granted through SC//Fleet Manager. It is strictly a surface for orchestration and observability, not a back door into the cluster.
Authentication
Access to SC//Fleet Manager is restricted to authenticated, role-based user accounts. Google’s Firebase handles authentication. It stores passwords with one-way hashing, so even Scale Computing cannot retrieve them. The Firebase integration also makes it easy to authenticate with:
- Google SSO for teams using Google Workspace.
- Microsoft Entra ID (formerly Azure AD) for teams using Microsoft 365 or hybrid Azure identity.
With SSO, you can keep MFA, session controls, and account lifecycle in one place: your existing identity provider.
Role-Based Access Control
SC//Fleet Manager’s Role-Based Access Control (RBAC) limits user accounts to specific tasks and actions within your fleet. For example, you can grant a Cluster Viewer role view and monitoring access to your clusters only. That role can’t add new clusters or update firmware. You can scope other roles for cluster onboarding, firmware management, or full admin rights, as your way of working requires.
This separation of duties in SC//Fleet Manager adds to RBAC on each SC//HyperCore cluster, as described in Access Control and Authentication.
Hosting, availability, and data handling
SC//Fleet Manager is securely hosted on fault-tolerant infrastructure at a major US-based data center provider. Data is securely backed up. So if an incident occurs, Scale Computing can recover quickly with little to no data loss.
Access to the underlying infrastructure and to SC//Fleet Manager data is limited to a small number of trained and authorized Scale Computing employees. Scale Computing’s privacy policy and operational controls govern all access. Your data is never shared and never sold.
The result is a cloud orchestration layer that lets you see and control your whole fleet. It needs no inbound network exposure. And it does not become a single point of failure or compromise for the clusters it manages.