Security
Reading a metric is a small ask. Changing a cooling setpoint is not. Everything below exists because the second one deserves a stricter answer than the first.
01 / Isolation
Each customer gets its own Postgres database, provisioned on signup. Not a shared schema with a tenant_id column — a missing WHERE clause cannot leak another customer's estate because the data is not in the same database.
Admin, operator, viewer and custom roles are evaluated on every state-changing request, server-side. Hiding a button in the UI is a courtesy, not a control, and we treat it as one.
A user can be limited to specific sites. The restriction is applied in the query layer, so a scoped operator's API calls return the same subset their dashboard shows.
02 / Write path
No action reaches equipment without passing all five, and none of them is optional or configurable away by us.
The suggester writes an action with its rationale, estimated saving and target.
Rate limit, single-active-per-target, time-of-day window and setpoint guardrails are all checked.
Low-risk reversible actions can auto-apply; impactful ones wait for a named human.
Prior state is stored before anything changes, so the rollback is data, not a guess.
Any applied action can be reverted for seven days, from the UI or the API.
03 / Practice
Every state-changing request is recorded with actor, target, before/after and source. Entries are denormalized so they survive the deletion of the object they describe — an audit log that disappears with the evidence is not one.
Passwords are bcrypt-hashed. Agent tokens are per-server and revocable. Equipment credentials (SNMP v3, Redfish) are stored encrypted and never returned by the API, only used by the collector.
Agents make outbound connections only — no inbound port on your hosts. Collectors run inside your network and reach equipment on the management VLAN; nothing on that VLAN needs to be exposed.
The whole platform runs as containers against your own Postgres and Mongo. If your policy says data does not leave the building, it does not have to leave the building.
We would rather answer it before the pilot than during procurement. Attach it to a contact request and an engineer — not a form-filler — will work through it.