Written for the person doing a vendor review. If you need something not covered here, ask — we would rather answer a specific question than have you infer.
- All traffic is encrypted in transit, including from the devices themselves — units verify the server's certificate rather than trusting whatever answers.
- Every customer's data is isolated. Which organization a request belongs to is derived on the server from the authenticated session; it is never accepted from the client, so a modified request cannot reach another customer's data.
- Credentials are stored only as one-way hashes. A copy of the database yields nothing that could be replayed as a device or a user.
- Reading history is append-only. There are no endpoints that edit or delete a reading, for anyone including us — corrections are new flagged entries.
- Anything destructive records a full snapshot of what existed beforehand.
- Credentials are never written to logs or the audit trail, and an automated check fails the build if one ever is.
Cross-tenant isolation is not only reviewed, it is tested: an automated suite runs on every change and attempts to reach one tenant's data as another. It has to pass before anything ships.
We keep a written security architecture document with the threat model and the requirements it holds us to. If your review needs it, ask and we'll share it.