Security and access control
What a security review needs to know, in one page. This is how the service runs
today.
How it is delivered
- Pull, not push. Your systems fetch from us over HTTPS. We hold no inbound access to your
network: no VPN, no agent, no callback, no firewall exception.
- Signed and verifiable. Every record is Ed25519-signed, time-stamped and carries a monotonic
sequence. Verify it against our published key before use; forged, altered
or replayed values fail the check. Reference verifiers in
Python and
JavaScript.
- Numbers only, into a DMZ. Plain JSON or CSV. Nothing executable, and never a direct link into
an OT network.
- A breach of us cannot harm your line. Your hard cap is enforced on our side and again on
yours, with fail-safe to your static rating. Full compromise of our systems returns you to the rating
you use today.
- On-premise option. The engine runs inside your own network, with no external connectivity.
Who can see what
Your account decides. An owner assigns each person the circuits they work on and, if they want, the date
and time that access ends.
| Role | Can |
|---|
| owner | Everything: add and remove circuits, invite people, cut keys, set end dates. |
| engineer | See their assigned circuits and cut keys for those circuits. Cannot change lines or people. |
| viewer | Read only. |
- Per-person circuits. Everything not assigned is invisible: the API returns 404, not 403, so a
restricted account cannot enumerate what exists.
- Access that ends. An end date is enforced on every request. Past that instant the session is
revoked, and signing in again does not get round it.
- Keys scoped to circuits. One key per consuming system, restricted to named lines, with an
optional expiry, a source-IP allowlist and one-click revocation. We store only a hash; a key is shown
once, at creation.
- A complete audit trail. Every value served, every sign-in, every configuration change — yours
to read and export.
Sign-in
There are no passwords to steal. We send a one-time enrolment code; the browser generates a P-256
key it cannot export; signing in means signing a single-use challenge with it. We store public keys only.
Owners invite people and revoke devices. Anyone signed in can mint a code for their own second machine —
same role, same circuits — and can sign their own device out.
Optional per key: HMAC request signing with a timestamp (±300s), a single-use nonce and an HMAC-SHA256
signature over method, path, timestamp, nonce and the SHA-256 of the body.
What we never ask for
- No operational data. Line specifications only: conductor, route, voltage, temperature limit.
- No network access. No VPN, no agent, no callback, no firewall exception.
- No sensors. Ratings come from public weather and the IEEE-738 standard.
Security questionnaire, or a call with whoever signs this off —
ask. A planning study needs none of it: no operational connection, nothing
installed.