Sync away from the site, without opening your network
A StepVane relay lets a phone sync with its PC when it is away from the site’s Wi-Fi: on a delivery run, in a yard, at a customer’s door. It is optional, it is off until you turn it on, and nothing connects in to your PC.
A small service on the internet that carries sealed messages
The relay stores and forwards bytes it cannot read. Your PC and your phones both connect out to it; neither has to be reachable from the internet.
Nothing connects in
Your PC keeps one outbound connection to the relay, over HTTPS. Phones reach the relay over HTTPS too. No port is opened on your site, and your PC is never reachable from the internet.
Sealed end to end
Everything is sealed between the PC and each phone, with keys made when the phone is paired on site. The relay keeps sealed messages only until they are delivered, then deletes them.
You choose who hosts it
Your own IT team or a provider you trust runs the relay. One relay can serve many sites, which suits an integrator who looks after several customers. There is no StepVane cloud account.
Three things happen, all sealed
-
The PC connects out
StepVane on the site’s PC keeps one outbound link to the relay. It uses a WebSocket over HTTPS, and plain HTTPS polling when a company proxy blocks WebSockets, so it works from behind most firewalls without any change to them.
-
The phone sends sealed requests
Away from the site’s Wi-Fi, a phone still saves its work on the device first. Then it sends its sync requests to the relay over HTTPS, sealed so that only its own PC can open them.
-
The PC answers
The PC collects the requests, does the usual sync (records in, updates and lookup data out) and sends sealed replies back through the relay. What the PC publishes for its phones, such as new app versions, lookup tables and operator lists, waits on the relay’s shelf, sealed so that only those phones can open it.
What whoever hosts the relay can and cannot see
The relay sees that messages pass, not what is in them. That is why it can be hosted by someone other than you.
It can see
- Random-looking ids of PCs and devices
- The size of each message, rounded up to coarse steps
- When PCs and phones talk
It cannot see
- Record values, scans, photos or signatures
- Lookup rows or app definitions
- Device tokens, worker names or passwords
- Which part of StepVane a request is for
The sealing uses HPKE (X25519 key exchange and ChaCha20-Poly1305), with keys made when a phone is paired, on site. Because who talks to the relay, and when, is visible to its host, host it where that information may pass. Off-site sync is your choice: without it, nothing leaves your network.
Minutes, not a project
Pick the way that suits the server you have. Each one sets up HTTPS for you and ends by showing an invitation for the first site.
One command on a Linux server
On a fresh Ubuntu or Debian server, run one command. It asks for the relay’s name and the first site’s name, sets up HTTPS by itself, starts the relay and prints the first invitation. A small command afterwards adds sites, upgrades, backs up and checks health.
A Windows installer
For a host that only has Windows servers: an installer sets up the relay and its HTTPS front end as two Windows services, with the same questions and the same invitation at the end.
Containers and other hosts
A Docker package builds the relay on any small Linux host, or on a container service that gives it one persistent volume and runs a single instance.
Connecting a site takes one paste
-
Make an invitation
On the relay, add the site’s name. The relay shows one invitation, once, to send to the site.
-
Paste it in Studio
On the site’s PC, open Server settings › Off-site sync, turn it on and paste the invitation. The address and access code fill in by themselves.
-
Test the connection
Press Test connection. Phones paired with that PC can now sync away from the site. You can pause or remove a site from the relay’s operator page at any time.
Questions
Do I need a relay?
No. Phones sync with the PC over the site’s own network, as always. A relay is only for phones that work away from the site’s Wi-Fi. Off-site sync is off until you turn it on.
Can the person who hosts the relay read my data?
No. Records, scans, photos, lookups and app definitions are sealed between your PC and your phones; the relay only carries them. The host can see which random-looking ids talk, when, and how large the messages are, rounded up. Host it where that information may pass.
What does a relay need?
A small Linux or Windows server with a public DNS name and ports 80 and 443 open to the internet, and nothing else. One processor core and 1 GB of memory are a sensible start. Disk is what to size for: messages wait there while a site’s PC is off and its phones keep sending.
Can one relay serve several customers?
Yes. Each site has its own access and its own sealed mailboxes, and the relay’s operator page lists the sites and can pause or remove any of them. That is how an integrator can look after many customers from one relay.
Does it work behind a company proxy or firewall?
Yes. The PC and the phones only make outbound HTTPS connections on port 443. Where a proxy refuses WebSockets, the PC falls back to plain HTTPS polling.
What does it cost?
The relay is not a separate item on the price list: StepVane licenses are per device and per worker (see Pricing). What you pay for is the server that runs the relay.
When can I get it?
The relay is released together with StepVane, and downloads are not public yet. See Get StepVane for where things stand, or contact us and we will tell you when it is ready.
Questions about off-site sync?
Tell us how your phones work away from the site and we will say whether a relay fits.