Refund me - Unexplained 900Mbps Data transfers to the cloud??

[weh]

Dear HexOS / Linus Tech Tips Team,

I hope this message finds you well. I'm writing regarding my recent HexOS purchase, which I bought as an early access product expecting simplified TrueNAS management. 

Unfortunately, I've encountered challenges that have led me to request a refund, and I need your help disabling the service.

What I Experienced

After claiming my server

1. Unexpected Network & disk: With no backup configured, I saw sustained ~900Mbps outbound traffic to link.storjshare.io and api.hexos.com via the wsocat WebSocket tunnel (PID 17377, 1MB buffers). This matched high disk reads from my media vault.

2. Difficult to Control: Killing wsocat stops it temporarily, but it restarts. midclt call service.stop "hexos-agent" fails (service not found). No clear GUI toggle exists.

3. Dashboard Dependency: Blocking the tunnel (with my firewall) eliminates uploads but breaks HexOS Deck access ("Server not available"). - Even removing the server from the HexOS cloud service does not stop this data transfer.

4. Unexpected Cloud Service Lock in: I didn't expect to be required to rely on your cloud service to maintain my own server, this goes against self hosted as a concept..

Why HexOS Isn't Valuable for Me

Honestly, I don't see much value in continuing with HexOS for the price I paid:

• Limited Features: The cloud dashboard and "simplified" management haven't demonstrated significant improvements over stock TrueNAS Scale.

• Early Access Concerns: I purchased during early access expecting rapid progress, but haven't seen meaningful updates or enhancements that justify the cost.

• Misleading Expectations: The aggressive cloud sync behavior felt like data exfiltration rather than helpful management, without clear opt-out options or bandwidth controls.

I feel somewhat misled by the early access promise—I expected a product evolving toward clear value, but the core issues (uncontrollable uploads, poor disable process) persist.

My Requests

1. Full Refund: I'd like to return to standalone TrueNAS Scale.

2. Official Disable Instructions: Step-by-step process to permanently remove the HexOS overlay/tunnel without data loss or reinstall.

3. Data Confirmation: What was uploaded during the sync? (Metadata only? Full files from my media vault?) And can you confirm/delete any stored data?

Thank you for understanding my position. I wanted HexOS to work but ultimately find it doesn't meet my needs. Your assistance with the refund and clean uninstall would be greatly appreciated.

[jonp]

Hi Seeg,

Refund requests can be made by simply emailing support@hexos.com, but one of our moderators has already flagged your account for a refund..  The behaviors you are reporting are not due to HexOS or TrueNAS SCALE.  We do not "exfil" your data in any way.  We simply provide a management platform for your server through an API.  We do not store copies of any of your data anywhere.  The 900mbps sustained data transfer you are claiming is likely coming from a 3rd party application you installed or something else on your network.  Otherwise I'd ask you to post any logs or evidence to support this claim so we can investigate further, as we do not see that behavior on any of our test systems or other reports from customers.

It appears you used AI to write this post and I'm guessing it got a lot of things wrong that you weren't aware of.  Not a problem, we will process a refund all the same.  We don't want any unsatisfied customers.  Thanks for giving us a try and we wish you luck on finding a better solution that meets your needs.

 

[jonp]

Oh and regarding this:

1 hour ago, seeg said:

Official Disable Instructions: Step-by-step process to permanently remove the HexOS overlay/tunnel without data loss or reinstall.

You can unclaim your system from the Settings -> Reset page without losing any data. 

[weh]

I appreciate the refund.

Here's a human written response, sorry the formatting isn't as fancy.

Correct - the post was summarized from a troubleshooting session late at night with Claude Sonnet 4.5
I got out of bed to notice this due to hearing "hard disk trying very hard" noises, which is unusual without someone using my Nas which alerted me to this issue (not the best alerting I admit)

I initially checked Disk reporting tab in TrueNas. Near 100% saturation of Sata lanes.
Then network tab (900Mbps of outgoing traffic)
Then I went to my router. I confirmed this was reaching link.storjshare.io (not something in my network, or a service I use)

There's no VM's on this Nas, no apps etc.
Just a simple disk pool. The only reason the Nas itself contacts the internet is to update etc. Usual traffic is very low.

I blocked this domain as I initially thought my network was comprised. This completely stopped hard disk activity and network activity in TrueNas reports.
Then when visiting Command deck I see I'm now unable to access my machine - this made me realize link.storjshare.io likely backs api.hexos.com - Can you confirm this?

Then, I toggled my new firewall rule - this then re-established deck.hexos.com connectivity. 
With the firewall rule paused I stopped my K3S cluster, which mounts this Nas as a share to rule this out - has done for a long time without issue.
The network / disk activity continues. It continues from TrueNas direct out to the internet. Not via any other server on my network.

The culprit:

www-data   17377  0.0  0.0   8636  4968 ?        Ss   18:30   0:00 /usr/local/libexec/wsocat --buffer-size 1048576 --ping-interval 30 --ping-timeout 60 --exit-on-eof --text ws://127.0.0.1:6000/websocket wss://api.hexos.com/server/<serverid>/<server_local_ip>

 

Out of interest, could you let me know what was wrong with my original post?
Unclaiming the server did not stop the network/disk activity issue as stated in my original post.

[jonp]

For us to dig deeper, I'd like you to report back with your hardware configuration as well as confirm what version of the OS you are running (25.10.1 or earlier?).  There were some issues with the TrueNAS SCALE network reporting graphs in earlier releases.  We'd also like to see a packet cap or something more than just a domain to prove what you're claiming here.  Maybe wireshark monitor?  Did you configure anything within TrueNAS SCALE's UI itself at any point or did you just utilize the HexOS dashboard for all your needs?

Lots of things could account for the disk activity itself (such as background tasks or maintenance operations like the scrub that happens by default once a month) but the network activity is not us.  StorJ is the used by TrueCloud if you configure your server to use it for backups (not something we support via HexOS today at all).  Furthermore, the storj connection and the websocat connections are independent of each other.  Websocat is used to make an outbound connection from a HexOS server to our Command Deck as outlined in one of our earlier blog posts here:  https://docs.hexos.com/blog/2024-07-30.html.  That's it.  We do not and cannot transfer your data via that connection.  The entirety of that connection is to give us API access to manage your system via our interface at deck.hexos.com.

5 hours ago, seeg said:

Unclaiming the server did not stop the network/disk activity issue as stated in my original post.

This ties back to something in TrueNAS and not anything with HexOS.  Once you've unclaimed your system, we no longer have any access to do anything with your system.

5 hours ago, seeg said:

Out of interest, could you let me know what was wrong with my original post?

Generally speaking, it was quite an alarmist post and makes some pretty aggressive claims about data being "exfiltrated", that we were "misleading" about our product, and that you haven't seen any "meaningful updates."

13 hours ago, seeg said:

I didn't expect to be required to rely on your cloud service to maintain my own server, this goes against self hosted as a concept..

This was stated in our very first blog post that I previously linked but you won't by reliant on deck.hexos.com for long:  https://docs.hexos.com/blog/2025-11-25.html.  Furthermore, having a management interface hosted via cloud doesn't go against self-hosting as a concept.  All of your data and applications are still running local on your LAN, which gives you the value of self-hosting.  Management interactions for most customers are limited to initial setup of storage, folders, users, and applications.  Once running, users mostly just interact with the applications and data, which run entirely local.

 

Ultimately we want to know if this is a real bug/issue that ties back to TrueNAS SCALE so we can escalate to the right people or if this is simply a misunderstanding or misconfiguration.  In reviewing multiple test systems we have configured and going back over a month in the network reporting, we see no significant network activity that matches anything close to what you are reporting.