01 / VISIBILITY
See the whole fleet.
Hardware, software, and device health in one clear view. Know what you have and how it’s doing.
Inventory & device health
Unified endpoint management
Every endpoint.
Every endpoint.
One clear picture.
Bring Windows, macOS, and Linux together. Manage inventory, apply policies, and support your team from a single console—hosted on infrastructure you control.
- WindowsPCs & servers
- macOSMac devices
- LinuxWorkstations & servers
02 / ACTION
Act in the moment.
Apply policies and support your team through a persistent command stream. Go from insight to action.
Policies & remote support03 / OWNERSHIP
Keep ownership.
Run on your infrastructure, with your data and encryption keys under your control. Make the fleet your own.
Self-hosted by design
Platform
Less busywork.
Less busywork.
More control.
The tools your IT team needs, connected by one lightweight agent and a persistent command stream.
Real-Time Fleet Command Streaming
Zero-latency telemetry dispatch and live interaction over persistent mTLS streams.
neouem> dispatch update --target=production-fleet --version=v1.12
[00:00.012] Pushed update manifest to 2,450 connected mTLS streams (RTT: 38ms)
[00:00.340] Staging binary /var/lib/neouem/staging/neouem-agent-v1.12... [OK]
[00:01.080] Cryptographic SHA-256 release signature verified on all nodes. [OK]
[00:01.420] ✓ 2,450 / 2,450 nodes healthy on v1.12 (Rollback disarmed) █
neouem> dispatch script --device=WIN-PROD-01 --eval="Get-BitLockerVolume -MountPoint C:"
[00:00.018] Signed envelope with tenant private key (ECDSA P-256 SHA-256).
[00:00.042] WIN-PROD-01 validated signature & freshness window (<10m). Executing...
Volume: C: | Protection: On | Encryption: XtsAes256 | Status: FullyEncrypted
[00:00.076] ✓ Command execution completed in 34ms. Escrow verified. █
neouem> osquery "SELECT name, pid, path FROM listening_ports JOIN processes USING (pid) WHERE port = 443;"
Executing distributed SQL query across 850 Linux hosts...
| caddy | 1420 | /usr/bin/caddy | 100% compliant
| nginx | 2891 | /usr/sbin/nginx | 100% compliant
[00:00.092] ✓ Distributed osquery query completed across 850 hosts in 92ms. █
neouem> connect pty --device=MAC-EXEC-04 --broker=mtls
[00:00.024] Established interactive WebSocket PTY broker stream. PTY dimensions: 120x34.
Darwin Kernel Version 24.1.0: arm64; root@mac-exec-04:~# uname -a
Connected to remote session with zero cloud relay intermediaries. █
Wire-Speed Dispatch
Bidirectional gRPC HTTP/2 streams replace sluggish 8-hour MDM polling loops with sub-50ms execution.
NeoUEM gRPC Dispatch
38 ms
Immediate cryptographic delivery
Legacy MDM / Intune Sync
Up to 8 hours
Passive polling & push-token lag
Total Data Sovereignty
Deploy on your bare-metal servers, VPC, or sovereign cloud. Zero telemetry reporting to third parties.
PostgreSQL row-level security
Hardened Row-Level Security policies prevent tenant data leaks at the query engine level. Privileged audit logs stay strictly in your custody.
Zero-Trust Device Cryptography
Internal X.509 Certificate Authority, per-device mTLS certificates, TPM 2.0 key escrow, and ECDSA command verification.
mTLS 1.3
ECDSA P-256
Key escrow
<20MB RAM Footprint
Zero runtime dependencies. No Node.js, Python, or JVM bloat. Statically compiled Go agent runs silently without throttling CPU.
Resident Set Size (RSS)
18.4 MB
Tested on macOS Sonoma, Windows 11 & RHEL 9
Self-Healing Watchdog
Autonomous supervisor process monitors agent binary health. If an update fails health verification, it performs an atomic rollback in <3 seconds.
Atomic binary swap
Dual-partition execution pattern guarantees your endpoints never become unmanaged or orphaned during network cutoffs.
Zero-trust
Two signatures on every action.
Fleet actions authenticate twice: mTLS 1.3 at the network, ECDSA P-256 on the payload. Tampered commands fail in memory and never reach the agent executor.
Escrow automation
BitLocker and FileVault recovery keys land in tenant-isolated tables.
Offline journal replay
Agents store policy locally during outages and reconcile when the stream returns.
From setup to clarity
A simpler way to run your fleet.
Make yourself at home.
Run the control plane with Docker Compose, Helm, or a Go binary on your own infrastructure.
Bring your devices together.
Enroll Windows, macOS, and Linux endpoints with the lightweight NeoUEM agent.
Turn visibility into action.
Inspect inventory, assign policies, and open remote sessions from one console.
Self-hosted
Run the control plane on your own hosts.
Ship with Docker Compose, Helm, or a single Go binary. Inventory, keys, and audit logs stay in your network.