Security
What we hold, and what we do not
Powoflow is designed for environments where getting this wrong is not a support ticket. Below is how isolation, identity and auditing actually work, and, at the bottom, an unvarnished statement of which certifications we hold. Today that list is short.
Authentication & access
Who can sign in, and what they can do once they have.
Organisations, ready to federate
Every tenant is created as its own isolated identity organisation with its own users, roles and invitations, which is the structure a corporate directory federates onto. Sign-in today is email and password or Google, and tenant admins bring in their own people. Directory federation is groundwork laid, not yet wired to a customer: raise it early and we will scope it with you.
Role-based access control
Two roles inside a tenant today, administrator and viewer, which is the honest description rather than the one that tests better. Granular per-module and per-record permissions are a common expectation and we would rather you knew the gap now than found it during an evaluation.
JWT validation
RS256-signed tokens with rotating keys. Issuer, audience and expiry are verified on every single request, before anything else runs.
Sessions that expire on their own
Web sessions are short-lived by configuration rather than by habit, and refresh tokens rotate. Revoking a person removes their access without waiting for a token to age out.
Device security
Every device has its own identity, from the sensor to the cloud.
Sensors join with their own keys
Each LoRaWAN sensor and tracker holds its own root key and joins the network with it, so every radio frame is encrypted and integrity-checked with keys no other device shares. One sensor's key opens nobody else's traffic.
On-Premise Agents with their own certificate
Each On-Premise Agent is issued its own certificate when it is provisioned and connects to the cloud over TLS with it. Removing one revokes its certificate without touching any other.
One identity per Powoflow Sense Mesa
Every Mesa carries its own certificate and a policy scoped to its own message topics, so one compromised unit cannot read another's traffic and can be revoked on its own.
Signed firmware where we write it
On the sensor nodes we design, the bootloader accepts only firmware signed with our key. Off-the-shelf sensors and gateways run their manufacturer's firmware and are updated through it, and we say which is which.
Infrastructure
Multi-layered cloud security with isolation at every level.
Multi-tenant isolation
Every row is keyed by the tenant that owns it, so isolation is a property of where the data physically sits rather than a filter someone has to remember to apply. There is no query shape that reaches another tenant, even by mistake.
Encryption
AES-128 over the LoRaWAN radio, TLS from every On-Premise Agent to the cloud, and AES-256 at rest, with keys held in a managed key store. Plant protocols on your local network, such as Modbus and the sensor-node stream, carry no encryption of their own and are as private as that network.
Hardened infrastructure
Runs on hardened cloud infrastructure with network isolation, least-privilege access policies and continuous monitoring. We inherit the certifications our infrastructure providers hold; Powoflow itself holds none yet, see Compliance status below.
Deletion that actually deletes
A tenant can be purged, and the deletion walks the graph rather than dropping a row and leaving orphans behind. Legal holds prevent anything under them from being removed while they stand.
Compliance status
Most vendor security pages imply more than they hold. This one is a statement of fact as of November 2026, and it will be updated when any line in it changes. If a certification is a hard requirement for you, the honest answer is below rather than in a footnote after a pilot.
| Item | Status | What that means here |
|---|---|---|
| SOC 2 | Actively pursuing | We are working towards it and will announce it once achieved. There is no report to send you today and we will not imply otherwise. |
| ISO 27001 | Actively pursuing | The information security management system is being built out towards certification. We will announce it when we have achieved it and not before. |
| GDPR | Built for it | Tenant isolation, per-tenant purge, consent records and a full audit trail are implemented, and we act as processor on your data under your instructions. Portability export and data-residency selection are designed and not yet built; if either is a hard requirement, raise it early. |
| ISA-18.2 · ISO 14224 · ISO 81346 | Implemented | These are engineering standards the product implements. An enforced failure-code vocabulary, a full alarm state machine, resolved reference designations. They are not certifications and nobody audits them. |
| Availability | No SLA yet | There is no contractual uptime figure or service credit today, and we will not quote a number we cannot yet measure end to end. We tell affected customers about outages, and an uptime commitment is something we will scope with you if it is a hard requirement. |
See also our privacy policy and terms.
Security we inherit, and security we add
A great deal of what protects your data is not something we wrote. Data is encrypted in transit and at rest by default rather than as something someone remembered to switch on. Keys are held in a managed key service, not in our code or our config. Every request arrives through a gateway that authenticates it before it reaches anything we built, and network isolation keeps the parts that process your data off the public internet entirely.
We take that as the floor rather than the finish. On top of it sit the things only we can do: tenant isolation enforced at the data layer rather than by a filter in application code, per-device identity and per-device authorisation for everything in the field, an audit record of every action that changes something, and a hardening baseline applied to every Mesa we provision.
Who we build on
We work with our partners to stay current with security standards and best practice, and we follow their hardening guidance rather than inventing our own: AWS for the cloud our data sits in, Cloudflare in front of the website and API, Auth0 for identity, and Nordic Semiconductor for the silicon in the devices we design.
The practical value of that is unglamorous. When one of them publishes an advisory or changes a recommended baseline, it reaches us as a change to follow rather than something we have to discover. Security work that depends on us noticing is security work that eventually gets missed.
Responsible disclosure
Found a vulnerability? Contact [email protected]. We take every report seriously and aim to acknowledge within two working days.