Nanoheal is included in the 2026 Gartner® Magic Quadrant™ for Digital Employee Experience Management Tools.In the 2026 Gartner® Magic Quadrant™ for DEX tools. See it on Gartner ↗

NanohealNanoheal
Schedule a demo

Platforms & architecture

One agent on the device, one console above it.

What the agent runs on, where the console lives, and how data moves between them. Start here before your security review.

Schedule a demo Trust & security
How it fits together
Above itOne console for every siteSigned in with SAML or OIDC
On each deviceThe Nanoheal agent
  • Windows and macOS, the same feature set
  • A fixed set of signed actions
  • Telemetry for the experience score
  • Fixes and policies keep running offline
1Mutual TLS
Your tenant on the Nanoheal serverSaaS on AWS, on-premises or air‑gapped
  • 2Data scoped to each site
  • 3Roles, MFA and a full audit log
  • 4Secrets stripped; API keys stored as hashes
  • 5Haya, Nanoheal’s AI and analytics, on your choice of model, behind approval gates
  • 6Hosted in your region; retention agreed
The numbers match “How data moves” below.
Data flow and security

How data moves, and who can see it.

The agent reports to your tenant on the Nanoheal server. These controls ship in the product.

Agent to server
Secured with mutual TLS.
Tenancy
Each customer or business unit is a site, with data scoped to each site, with requests for another site refused.
Access
Role-based access, MFA and a full audit log, with SAML and OIDC single sign-on.
Secrets and keys
Secret fields stripped from responses and redacted from logs; site-scoped API keys, stored only as hashes.
AI
Haya runs on your choice of model, including a locally hosted one, behind approval gates, role-based access, execution traces and PII masking.
Residency and retention
Hosted in the region set for your deployment, with retention and deletion agreed with each customer, by deployment and contract. Data protection

Numbered as in the drawing above ↑

Supported platforms

Windows and macOS, with the same feature set.

The same agent capabilities, the same library and the same console on both, so a mixed fleet is one estate, not two.

PlatformMeasureFixGovern
WindowsWindows 10, Windows 11 and Windows Server, including point-of-sale terminals Telemetry, anomalies and the experience score On its own, offered to the employee, run by the desk, or scheduled Software, patches and policy, with the audit log
macOS Telemetry, anomalies and the experience score On its own, offered to the employee, run by the desk, or scheduled Software, patches and policy, with the audit log
Nanoheal console: one fleet in one console, counted by operating system: 63 devices, Windows 47, macOS 10, Android 0 and Linux 5
Nanoheal console · Devices, one fleet counted by operating system

Other platforms

Linux Most of the macOS feature set. Details vary by distribution.
Android Kiosk mode, device management, data collection and the experience score.
iOS Data collection and the experience score. Narrower than Android, because Apple limits what an agent can do on iOS.
VDI Device monitoring, automation and the experience score.
ChromeOS In proof of concept.

Supported versions differ by platform and distribution. Ask us for the versions you run.

Scores are built from a default set of metrics across device, application and network health.

Deployment

SaaS by default, or on your own infrastructure.

The agent is the same everywhere. What changes is where the server and its data run.

  • SaaS

    Runs on AWS by default, with Azure and GCP customer environments also supported, in the region set for your deployment.

  • On-premises

    The deployment architecture is tailored to your infrastructure.

  • Air-gapped

    Possible, with a design that covers disconnected operation, licensing, updates, dependencies and telemetry.

  • Many tenants, one platform

    The platform is multi-tenant, with per-tenant branding and licence pools, so a service provider runs every client from one console.

The agent side never changes; only the server’s place does.

The agent

What sits on the device.

What it can do
It works from a fixed set of signed actions. A new fix is a set of parameters for those actions, and each flow passes a check that stops anything incomplete before it is staged.
What it measures
Endpoint and digital-experience telemetry, for monitoring, analytics, troubleshooting and automated fixes. We provide field-level collector detail, shared through our technical and security review process.
Footprint, installation and updates
The agent footprint stays flat as automations are added, because each fix uses capabilities the agent already has. Measured figures, installation and update methods, and signing detail are in our technical whitepaper, shared on request. Request it
Offline
Fixes and policies keep running without a cloud connection, where the policy or automation does not need one.
Haya Inventory and Coverage: 200 devices reporting, 200 of 200 resolved in identity to department, business unit, OU and AD site, 200 with software inventory, 13 of 200 stale for 7 days or more, with demo tenant data
Haya analytics · Inventory & Coverage, who is in the data
Haya Device 360, live streams for one device: pressure by hour over the last 24 hours, and current pressure, CPU 68%, memory 86%, disk free 47% and network delay 66 ms; each point is a real sample, with demo tenant data
Haya analytics · Device 360, live streams: each point a real sample