Vrymdor Business Security: Official Onboarding and Deployment Guide

Welcome to Vrymdor. This page has everything you need to connect your first server in a few minutes.

Vrymdor is built so that protecting your systems never means opening them up:

• Outbound only, over TLS on port 443. The Vrymdor connector calls out to Vrymdor. Nothing ever calls in.
• Zero inbound firewall changes. No ports to open, no VPN to set up, no public IP address needed.
• Zero egress AI. Your logs are reviewed on your own server by a local AI model (llama3.2:3b). The model has no internet access, and raw logs never leave your server. Vrymdor receives only counts and health.

1. Before you start

Your server needs:

The first install downloads the local AI model once (about 2 GB). For a site with no internet access at all, ask us about the offline installation kit.

2. Install with one command

Copy this into a terminal on the server you want to protect:

curl -fsSL https://get.vrymdor.com/install.sh | AWARENESS_TOKEN="YOUR_ASSIGNED_TOKEN_HERE" bash

Your token is already filled in if you copy the command from your approval email. You can also type it in yourself: replace YOUR_ASSIGNED_TOKEN_HERE with the token from the email (it starts with vrym_live_). Or leave AWARENESS_TOKEN="..." out entirely and the installer asks for it, which keeps it out of your shell history.

When the installer asks for your token, paste only the line under Your token in your approval email. That line is the token alone, so there is nothing to trim. (If you paste the whole command by mistake, the installer keeps just the token from it.)

Treat the token like a password. Anyone holding it can report as your workspace. If it is ever exposed, email support and we rotate it for you within minutes.

The installer:

1. detects Linux or macOS (Windows has its own installer, below) and checks the disk space, the memory and outbound HTTPS,
2. installs anything missing: curl, tar and CA certificates, Docker Engine, Docker Compose v2 and Buildx (Ubuntu, Debian, 64-bit Raspberry Pi OS, Fedora, RHEL, Rocky, Alma, Oracle Linux, Amazon Linux and SUSE), then starts Docker and sets it to start at boot,
3. installs into /opt/vrymdor (Linux) or ~/.vrymdor (macOS),
4. downloads the connector bundle and verifies its checksum,
5. saves your settings in a private .env file (readable only by you),
6. starts the connector and the local AI model.

Want to check the installer before you run it? Download it with its checksum file and verify it first:

curl -fsSLO https://get.vrymdor.com/install.sh && curl -fsSLO https://get.vrymdor.com/SHA256SUMS
sha256sum --check --ignore-missing SHA256SUMS && AWARENESS_TOKEN="YOUR_ASSIGNED_TOKEN_HERE" bash install.sh

Prefer to do it by hand? See the manual installation guide.

Give each server its own name

The installer asks one question after the token:

Name for this server in Vrymdor [web-01]:

Press Enter to keep the name in brackets (the server's own host name, or the name it had before when you run the installer again), or type another name, for example office-file-server. Letters, digits, spaces, dots, dashes and underscores work, up to 63 characters.

The same command, with the same token, works on every server you protect. Run it on each one and give each a different name: your dashboard then shows them side by side under Servers, each with its own health, activity and scans. To set the name without being asked (in a script, for example), put NODE_LABEL in front of bash:

curl -fsSL https://get.vrymdor.com/install.sh | NODE_LABEL="office-file-server" AWARENESS_TOKEN="YOUR_ASSIGNED_TOKEN_HERE" bash

To rename a server later, run the install command again and type the new name. It stays the same server in your dashboard, with its history.

Install on Windows

Open PowerShell as Administrator (right click PowerShell, then Run as administrator) and paste the Windows command from your approval email. It looks like this:

$env:AWARENESS_TOKEN='YOUR_ASSIGNED_TOKEN_HERE'; irm https://get.vrymdor.com/install.ps1 | iex

On Windows Server 2016, if PowerShell answers Could not create SSL/TLS secure channel, run [Net.ServicePointManager]::SecurityProtocol = 'Tls12' in the same window first, then the command again.

Leave out $env:AWARENESS_TOKEN='...'; and the installer asks for the token instead: paste only the line under Your token in your approval email. It asks for the server's name the same way as on Linux (Enter keeps the computer name), and $env:NODE_LABEL='office-file-server'; in front answers it without asking.

The Windows installer:

1. checks for Windows 10, Windows 11 or Windows Server 2016 or newer on 64 bit Intel or AMD, administrator rights, 10 GB of free disk, 4 GB of memory and outbound HTTPS,
2. installs into C:\ProgramData\Vrymdor: the connector, a private copy of Python from python.org and the Ollama model runtime from Ollama's official release, each checked against its SHA-256 checksum before use, then downloads the local AI model (about 2 GB),
3. saves your settings in C:\ProgramData\Vrymdor\.env, readable only by SYSTEM and Administrators,
4. blocks the model runtime from the internet with a Windows Firewall rule once the model is in,
5. adds three scheduled tasks that start with Windows and restart on failure: Vrymdor Model (the local AI model, listening only on this computer at 127.0.0.1), Vrymdor Connector and, when the self scan is on, Vrymdor Scanner.

On Windows the connector reads the Security and System event logs and counts failed and successful sign ins (at the console and by Remote Desktop), users added to an administrators group, new user accounts and newly installed services. As on Linux, the events themselves stay on the server; Vrymdor receives only the counts. Windows has no Docker network to wall the model off, so the installer does it with Windows Firewall: once the model is downloaded, a rule named Vrymdor Model: no internet blocks the model runtime from connecting out, and the model listens only on this computer (127.0.0.1). If your Group Policy turns off local firewall rules, ask your administrator to add the same outbound block for C:\ProgramData\Vrymdor\ollama\ollama.exe.

Check a server first (optional)

To get a server ready before you have your token, run the installer with VRYMDOR_PREFLIGHT_ONLY=1. It checks the disk, the memory and outbound HTTPS, installs everything missing (Docker included), and stops before the token and the connector:

curl -fsSL https://get.vrymdor.com/install.sh | VRYMDOR_PREFLIGHT_ONLY=1 bash

It ends with "Everything this server needs is installed". Run the full install command later; it skips what is already there.

3. Check that it works

On the server:

cd /opt/vrymdor        # or: cd ~/.vrymdor on macOS
docker compose ps

You should see connector and ollama running, and model-seed exited with code 0. Then:

docker compose logs -f connector

Look for handshake ok. That is your server introducing itself to Vrymdor.

Check a Windows server

In PowerShell opened as Administrator:

Get-ScheduledTask -TaskName 'Vrymdor*'
Get-Content 'C:\ProgramData\Vrymdor\logs\connector.log' -Tail 20

The tasks show as Running, and the log shows handshake ok.

In your Vrymdor dashboard, open Servers. Your server appears within a minute of the handshake, marked Online, and its health and activity update every minute after that. "Local AI ready" turns on once the model has finished loading.

4. Protect your cloud and code (optional)

These need no server at all:

• GitHub repositories: pushes, force pushes, pull requests, collaborator changes and branch protection changes.
• AWS accounts: sensitive CloudTrail activity through EventBridge, with one CloudFormation stack and no access to your account for Vrymdor.
• Identity providers: sign ins, failed sign ins, password resets and second factor changes from Keycloak or any provider that can send a webhook.

5. Security scans of your servers

A self scan has your server look at its own addresses for open services that put it at risk (for example Telnet, an open database or the Docker API). The server scans only itself; Vrymdor never names a target. The results show which ports are open, how serious each one is and what to do about it, without any of your addresses.

• Turn it on at install. The self scan is on when the install command includes VRYMDOR_SELF_SCAN=1. The command in your approval email includes it when Vrymdor has turned it on for new installs; if yours does not, add VRYMDOR_SELF_SCAN=1 before bash. To turn it on later, run the install command again with VRYMDOR_SELF_SCAN=1 before bash.
• Unlimited and continuous, on every plan. There is no daily limit on Core Guard, Active Defense or Sovereign Vault. Each server gets a schedule the moment it connects: it scans itself every hour, starting a few minutes after it first reports in. The server card in Posture shows the state in words, for example "Scanning every hour, last scan 12 minutes ago".
• Scan now. In the Vrymdor app, open Business Security, then Posture. Each online server has a Scan now button, always available. Results arrive within a few minutes. One scan runs at a time on each server, and a new start waits 60 seconds after the last one, so a double click cannot start two.
• Change or pause the schedule. Choose Edit schedule on a server: continuous every 15 or 30 minutes, or every 1, 2, 4, 6 or 12 hours; once a day at a time you pick in your time zone; or pause. A paused server still scans when you press Scan now.
• Alerts. A scan you start always tells you when it finishes. A scheduled scan alerts you only when there is news: a high finding the previous scan of that server did not have, or a scan that failed after one that worked.
• Who can start them. A workspace admin who signed in with a second factor. Everyone in your workspace can see the results and who started each scan.

6. Everyday operations

Run these in the install directory: cd /opt/vrymdor on Linux (put sudo in front of each command), or cd ~/.vrymdor on a Mac.

Remove from a Linux server

Paste this one line into a terminal. It stops the connector, removes its containers, data and images, then deletes /opt/vrymdor with the token. Docker itself and your other containers are left alone.

sudo docker compose -f /opt/vrymdor/docker-compose.yml down -v --rmi all && sudo rm -rf /opt/vrymdor

Remove from a Mac

The Mac install lives in ~/.vrymdor. Paste this one line into Terminal:

docker compose -f ~/.vrymdor/docker-compose.yml down -v --rmi all && rm -rf ~/.vrymdor

Remove from a Windows server

The installer leaves a remover next to its folder. Paste this one line into PowerShell opened as Administrator:

powershell -ExecutionPolicy Bypass -File C:\ProgramData\Vrymdor-uninstall.ps1

If that file is missing (it was deleted, or the install never finished), this one line does the same:

irm https://get.vrymdor.com/uninstall.ps1 | iex

It stops and removes the scheduled tasks, the connector, its Python and Ollama copies and the local AI model, removes the firewall rule, deletes C:\ProgramData\Vrymdor (with the token) and removes any line holding the token from every user's saved PowerShell history. Another Python or Ollama on the server is left alone. To upgrade, run the install command again: your token, the server's name and its history are kept.

7. Signing in, and if you forget your password

You sign in to your dashboard at https://app.vrymdor.com/login with your email address, your password and, after that, the code from your authenticator app. Every password box has a Show password button (the eye) if you want to check what you typed.

Forgot your password

1. On the sign in page, choose Forgot password?
2. Enter the email address you sign in with and complete the security check.
3. Open the email from Vrymdor and choose the link in it. The link works once and expires after 30 minutes; if it has expired, ask for a new one.
4. Choose a new password of at least 10 characters and type it twice.
5. Sign in with the new password. If your account uses an authenticator app you still enter its code: a new password never turns that off.

When the password changes, every device signed in to your account is signed out, and you get an email saying so. If you get that email and did not change your password, reset it straight away and write to support.

Forgot which email you used

Choose Forgot which email you used? on the sign in page and enter an address you might have used. If it has a Vrymdor account, that address receives an email listing the workspaces it can sign in to, with a sign in link. For your privacy the page says the same thing whatever address you enter, so check each inbox you use. Your workspace administrator can also tell you which address they invited.

Lost your authenticator app? Write to support. We check it is really you before we help you set up a new one; this is never done from a link.

You can change your password at any time while signed in, from Change password at the bottom of the menu.

8. Support

• Email: [email protected]
• Response time: we reply to every request within one business day, and we look at anything that affects your protection first.
• Please include your company name and, if a command failed, the last lines of docker compose logs connector (on Windows, of C:\ProgramData\Vrymdor\logs\connector.log). Never send us your token.