# Administer

> Manage who can sign in and what they can do, the hub's certificates, license and configuration, and the logs and records you need when something fails.

Source: https://proxus.io/docs/administer

This section is for the person who looks after a Proxus hub: who may sign in, what each person may see and change,
which certificates and license the hub uses, how it is configured, and where to look when something goes wrong. In
the hub, **Users**, **Roles** and the **Certificate Store** are in the **Security** menu. The other screens are in the
**Platform** menu. UNS permissions you also give from **Organize > UNS Explorer**.

## What you manage here

| Screen | What it is for |
| --- | --- |
| **Users** | One entry per person or system that signs in. A user gets what its roles allow. |
| **Roles** | Sets of permissions: which screens, which kinds of records, which actions, which parts of the Unified Namespace. |
| **My Profile** | Your own account: change your password, see your roles. |
| **White Labeling** | Your own application title and logo, if your license includes it. |
| **License Info** | What your license allows and how close each edge gateway is to its capacity. |
| **Certificate Store** | The platform's certificate authority, and every certificate for HTTPS, the hub's NATS server, the gateways, OPC UA connections and outbound targets. |
| **Copilot Settings** | The AI services Copilot answers with, and their API keys. See [Set up Copilot](https://proxus.io/docs/administer/copilot-settings). |
| **Config Editor** | The hub's configuration file, edited in the browser. |
| **System Logs** | Warnings and errors from the hub and every edge gateway, and the support bundle. |
| **Database Health** | Size, disk use and retention of the telemetry database. See [Monitoring](https://proxus.io/docs/operate/monitoring). |

Every saved record also has an **Audit Trail** button that shows who changed what, and when.

## Start here

Every connection of the platform can be encrypted with TLS: the hub's HTTPS (port `8443`), the NATS links between the
hub and the gateways, the gateways' MQTT brokers (port `8883`), outbound targets and OPC UA connections. HTTPS and the
NATS links are encrypted by default. The plain ports `8080` (HTTP) and `1883` (MQTT) stay open for local access and
devices without TLS until you close them: see [Security hardening](https://proxus.io/docs/operate/security#hardening-checklist). The
certificates for all TLS connections come from the Certificate Store. See [Security](https://proxus.io/docs/operate/security#what-is-encrypted).

To install, upgrade, back up or secure the installation itself, see [Install and operate](https://proxus.io/docs/operate).