Security

On the hub, in your home. The measurements themselves and the device registry are kept on its memory card, not on our servers; three short summaries made from them are in our cloud, so the Statistics screen works while you are away. Your floor plan is kept there too, and a copy of it is in our cloud so that it can be shown in the app and here while you are away, encrypted with a key of its own. The address, the map position and the photo of your home are in our cloud as well, encrypted the same way: the privacy policy says exactly what we hold and why.

The interface you use is served by the hub itself, so looking at your own home does not send a request anywhere.

Each hub is registered during manufacturing and receives an identity document signed by us. It carries that document and checks it when it starts.

The identity is bound to the chip on the board, not to the memory card. Replacing the card does not make it a different device, and copying the card does not produce a second one.

A hub does not run unattended upgrades. No blanket package updates that nobody tested together.

An update is one release: the application, its dependencies and the runtime, tested as a set. Every file in it is identified by its SHA-256 hash, so a modified file is simply a different file.

Delivery of updates to customers is still being built. Today it is a controlled process on our side, not an automatic one on yours.

There is no support tunnel, no always-on connection for us to reach into your home, and no shared key that would open every hub in the field. This is not a promise for later — none of it is built.

Remote support is being designed. When it exists, we will describe exactly how it works before anyone uses it.

Watching your own camera from away is a connection you open, not one we hold: it needs a key set on the hub itself, which never reaches us. The privacy policy sets out exactly how it works, including the one step that key cannot protect.

The configurator reads your plan inside your browser. The file is never uploaded: we do not receive it, we do not store it, and there is nothing for us to lose.

A floor plan says a great deal about a home — its layout, its size, sometimes its address. The file you upload to this configurator we simply never receive. A file you hand to your hub is a different matter: that one does travel to our cloud, and the privacy policy says what we hold, how it is kept, and why it is worth reading a file before you hand it over.

Some things you type are meant for your hub and not for us: the key that opens a camera, the password of your home network. They are sealed in your browser with your hub's own key, and we carry the sealed parcel without being able to open it. That part is arithmetic, not a promise.

But the page that does the sealing is handed to you by our servers, fresh each time you open it. Whoever could change what those servers send could take the key before it is sealed. No amount of encryption fixes that, because it is not the road that is weak — it is the door.

Our app is different, and this is the reason it exists as an app rather than as this site in a frame. Its code is signed, checked by the store, and installed on your phone once. We do not hand it to you anew each time you open it, and changing it means publishing a new version — which is slow, visible and leaves a trail. Where the same thing can be done in both places, that is the difference between them.

We would rather write this down than let you assume otherwise. It is also why the fingerprint you check your hub's key against is shown on the hub's own screen, and nowhere else: a fingerprint shown by a page we serve would prove nothing, because it would be changed along with the page.

• no analytics, no advertising trackers, no third-party scripts
• no cookie banner, because there are no cookies that would need your consent
• fonts are served from this domain, so your browser does not tell anyone else that you were here