Security
Designed to control and protect your organization's data
This page describes what the system does today, as it actually works, and clearly separates what is still on the roadmap.
What the system does today
Encryption on every connection
Every endpoint uses TLS. Gateways send data over MQTT on encrypted port 8883 only; no unencrypted port is open.
A credential per gateway
Each gateway has its own credential, which can be rotated and revoked immediately if the device is lost or retired.
Sign-in
Passwords are stored as argon2id hashes, and session cookies are set HttpOnly, Secure and SameSite.
Data isolated per organization
Every customer record belongs to an organization, and the database enforces separation with Row-Level Security as a second layer behind the application's own filtering.
Role-based access
Administrators, engineers, operators and view-only users, assigned for the whole organization or per site.
Audit log
Records sign-ins, configuration changes, gateway claims and releases, and user role changes.
Network
Internal services accept connections only through the reverse proxy, and the database is not reachable from the internet.
Backups
Encrypted nightly database backups stored off the server, with a restore test every month.
Rate limiting
Sign-in, gateway registration and API calls are rate-limited to slow down password guessing and request flooding.
Security roadmap
Coming soonThe following are not available yet; they are on our roadmap.
- Mandatory MFA for administrators
- SSO (OIDC) for Enterprise customers
- mTLS: a client certificate per gateway
- WireGuard / VPN for Enterprise customers
- Point-in-time recovery (PITR)
- Audit log of commands sent to devices, once commands are enabled
Questions from your IT team?
Send us your security questions; we answer based on what the system actually does.
Contact our team