Manage
Security and Compliance
Edited
Pleneo IT deployment and security guide
Network requirements, ports, and security model for deploying Pleneo in an enterprise environment.
Network architecture
RoomHub has two independent, isolated Ethernet interfaces (no bridging between them):
LAN 1 (control network): management, configuration, and integration. Can also carry device communication
LAN 2 (audio and video network): real-time media and communication with audio and video devices in segmented networks
Device control can run on LAN 1 or LAN 2, depending on how devices are connected. Multicast is required on the audio and video network for real-time audio.
Management access (LAN 1)
Service | Protocol | Port | Direction | Encryption |
|---|---|---|---|---|
Web interface | TCP | 443 | Inbound | TLS 1.2+ |
RoomHub uses a self-signed certificate by default; browsers show a warning on first access. Validate and accept it during setup.
Device communication
Purpose | Protocol | Port(s) | Direction | Encryption |
|---|---|---|---|---|
Device control and monitoring | TCP | 19150–19152 | Outbound | None (local network) |
Device heartbeat / discovery | UDP | 19153 | Inbound | None |
Secure device control | TCP | 443 | Outbound | TLS 1.2+ |
Legacy device control | TCP | 45 | Outbound | None |
Vendor-specific control | TCP | 2202 | Outbound | None |
Camera control (VISCA over IP) | UDP | 52381 | Outbound | None |
Camera discovery / session init | UDP | 45 | Inbound | None |
Real-time audio (multicast) | UDP | Dynamic | Bidirectional | None |
Unencrypted control traffic runs on the local network only.
Firewall configuration
Source | Destination | Port(s) | Protocol | Direction | Purpose |
|---|---|---|---|---|---|
Admin workstation | RoomHub (LAN 1) | 443 | TCP | Inbound | Secure management access |
Devices | RoomHub | 19153 | UDP | Inbound | Device heartbeat/discovery |
PTZ cameras | RoomHub | 45 | UDP | Inbound | Camera session initiation |
RoomHub | Devices | See device communication | TCP/UDP | Outbound | Device communication |
Network requirements
Category | Requirement |
|---|---|
Management access | HTTPS (TCP 443) |
Device communication | LAN 1 and/or LAN 2 |
Multicast | Required for real-time audio |
VLANs | Strongly recommended |
LAN 2 is required when using a segmented media network or a dedicated audio and video VLAN.
Security
Authentication: single local admin account. Set the password directly on first-time setup; no default or shared password. Enforced policy: 12+ characters with upper, lower, numeric, and special characters
Network access control: IEEE 802.1X on LAN 1 (EAP-TLS certificate-based authentication)
Encryption: all management interfaces require HTTPS (TLS 1.2+); no plaintext management interfaces
Segmentation: LAN 1 for control, LAN 2 for media; separate VLANs recommended
Communication model: RoomHub initiates communication outbound; inbound is limited to the UDP discovery ports above (19153, 45). No general-purpose inbound control interfaces
Deployment checklist
Restrict LAN 1 management access to authorised subnets
Separate control and media networks using VLANs
Allow only the required ports between segments
Limit inbound UDP to ports 19153 and 45
Monitor with your standard IT security tools
Compliance
Pleneo's security and compliance program aligns with recognised international standards, including SOC 2 Type 2, ISO/IEC 27001 for information security, and ISO/IEC 42001 for AI management.