Security and privacy
ICX Setup handles switch credentials and pushes firmware, so it’s built to be careful with both. Here’s exactly what it stores, what it logs, and what leaves your Mac.
No account, no backend, no telemetry
Section titled “No account, no backend, no telemetry”ICX Setup has no sign-up and no cloud service. It talks only to the switch in front of you — over the console cable or SSH on your local network — and, during an upgrade, serves firmware to that switch from your own Mac. Nothing is sent to the internet and there is no analytics.
Secrets live in the Keychain
Section titled “Secrets live in the Keychain”Everything sensitive is stored in the macOS data-protection Keychain (service
com.neuralconfig.ICX-Setup), never in plain preferences:
- Switch passwords you save in Settings.
- Pinned SSH host keys (see below).
- Ephemeral TLS material for the firmware server — generated per session, marked never to sync off the device, and deleted when the server stops.
Keychain items are only accessible while the Mac is unlocked.
SSH host-key pinning
Section titled “SSH host-key pinning”ICX Setup pins each switch’s SSH host key on first connection (trust on first
use) and refuses to connect if the key later changes — a guard against someone
impersonating the switch. The stored fingerprint is a standard OpenSSH
SHA256:… value you can verify with ssh-keygen -lf.
It fails closed: if it can’t read a pinned key from the Keychain, or can’t save a new one, it refuses the connection rather than trusting an unverified key. See Connecting to a switch for what to do when a key legitimately changes after a factory reset.
Session logs are written automatically, and redacted
Section titled “Session logs are written automatically, and redacted”Every connection is logged. ICX Setup opens a log file the moment a serial or SSH session starts and closes it when the session ends — there is no setting to turn this off. Reveal Log, in the terminal drawer, opens the current file in Finder.
Logs are written inside the app’s sandbox container, under
Library/Logs/ICX Setup/, one file per session named for the time and the
connection — for example 2026-07-25_143012_SSH-192.168.1.10-22.log or
2026-07-25_143012_cu.usbserial-A1B2C3.log. They are plain text, they are not
rotated or deleted for you, and nothing sends them anywhere. Delete them
yourself when you no longer want them.
Before anything is written, ICX Setup masks secrets, replacing them with
[redacted]:
- Your saved switch passwords.
- Secrets in config lines — the value after
password,community, orkey(includingenablepasswords, SNMP community strings, and RADIUS/TACACS keys). - SNMPv3 auth and privacy secrets.
Redaction works on whole lines, so a secret split across two reads can’t slip through. Password prompts aren’t echoed by ICX, so typed passwords never reach the log in the first place.
The firmware server
Section titled “The firmware server”During an upgrade, firmware is served from your Mac over HTTPS, not TFTP:
- A self-signed certificate (RSA 2048, with your Mac’s IP as its subject
name) is generated in-process each session — no
opensslshell-out, so it works inside the App Sandbox. - Each session mints a random per-session token that must be the first part of the request path; requests without it get a 403.
- The server only serves files from the firmware folder you selected, and resolves paths so a request can’t escape that folder.
ICX Setup also records the SHA-256 of the exact image it served, so you can compare it against the vendor’s published hash and detect a tampered file.
Next steps
Section titled “Next steps”Questions about how something is stored or transmitted? Contact support.