Built for scrutiny
Safety data has to hold up. Here's exactly how account access, sessions, and your fleet's data are protected.
Account security
- —Authenticator-app TOTP MFA with eight single-use recovery codes
- —MFA secrets encrypted at rest, never stored in plaintext
- —Five consecutive password failures lock the account for 15 minutes
- —Password changes and MFA changes revoke every existing session
- —Active-session listing with individual session revocation, or log out everywhere at once
Session & transport
- —Opaque, Redis-backed session tokens — never a forgeable JWT
- —HttpOnly, Secure, SameSite cookies; sessions can't be read or replayed from JavaScript
- —Every cookie-authenticated write requires a per-session CSRF token
- —CSP, clickjacking, MIME-sniffing, referrer, and permissions headers on every response
- —TLS everywhere via Let's Encrypt — no unencrypted endpoint
- —Portal sessions expire after 12 hours and admin sessions after 8, regardless of activity — end any session early any time from Active Sessions
Tenant isolation
- —Every session or API key resolves to a vendor on the server — never trusted from the client
- —No caller-supplied tenant ID is ever accepted, by design
- —Suspended or closed customers lose both web and API access immediately
- —Disabling one access channel (web or API) never silently disables the other
Credentials & audit
- —API keys and device claim codes are stored only as one-way hashes — never recoverable, even by us
- —Production API keys are shown once, support atomic rotation, and can be set to expire on a fixed term (30–365 days)
- —Webhook payloads are HMAC-SHA256 signed and delivery URLs are SSRF-guarded
- —Every admin action is written to an immutable audit log — actor, role, request, status, IP, timestamp
- —Emergency break-glass access requires two-person approval and is separately audited
Have a security questionnaire or need a deeper technical review?
Talk to usSee also our Privacy Policy for how we handle data.