Your IoT data, secure by design

Security on an IoT platform cannot be an afterthought, because the data it carries is often the basis for safety, compliance and operational decisions. We design for it from the start. The same UK team that engineers the devices builds the platform that receives, stores and surfaces their data, so security is considered at every layer rather than patched on at the end. That means sensible defaults — encryption on, least-privilege access, logging enabled — rather than options a client has to remember to switch on.

Monitoring is only useful if the right person hears about a problem while there is still time to act. Each reading and event is checked against the thresholds set for that sensor as it arrives, and an alert goes out straight away by email, SMS or both, or through an app where the client wants one. Thresholds are set sensor by sensor: a high or low limit, a reading that drifts slowly over several hours, a door left open outside agreed hours, a contact that changes state. On a 4G gateway, an alert reaches the dashboard about a second after the reading arrives.

Alerts go to named people for each site, with escalation to further contacts when the first person does not respond, so an out-of-hours alarm does not sit unread in one inbox. Silence counts as a fault as well. Every tag checks in on a schedule set for the site, so a tag that stops reporting raises its own alert, and gateways carry battery backup, with the platform alerted the moment one loses mains power. Every alert is kept in a timestamped event history, held in the cloud or on the client's own servers, and alerts are never metered or charged per message.

Telemetry is encrypted on its way into the platform and encrypted while it is stored, using industry-standard encryption — TLS in transit, AES at rest. Data is not left in the clear at any point a client would reasonably expect it protected, and the links between systems are secured too. The aim is simple: at no stage between a device in the field and an authorised user's screen is your data casually readable by anyone who should not see it.

Access is role-based and least-privilege by default: people and systems see only what their role needs, and nothing more. Permissions are explicit, and changes to them are recorded. Every meaningful action on the platform — a login, a configuration change, an export — is logged, so there is always a clear, timestamped account of who did what and when. When an auditor, a board or a regulator asks how your data is handled, the answer is in the record rather than in someone's memory.

In a multi-site, multi-client world, separation matters. Data is held apart site by site and client by client, so one tenant's information is never exposed to another's. Every device carries its own identity, which means telemetry can be trusted to have come from the device it claims to, and a single compromised credential cannot quietly speak for the whole estate. That separation is part of the design, not a configuration a client has to assemble themselves.

A platform is only secure if it is also there when you need it. It is built for high availability and monitored continuously, so problems are seen and dealt with rather than discovered by the client. Telemetry is buffered and reconciled, so a temporary loss of connectivity does not mean lost data — readings come back in order once the link is restored. And because the platform is built and supported by the same UK team that engineers the devices, support is people who understand the whole system, not a first-line script.

Many of our clients operate under real compliance obligations — in water, construction, energy, the public sector and beyond. The platform is built to make meeting them easier: encryption, access control, audit logging and data separation are exactly the controls those frameworks expect to see. We work to your specific requirements rather than claim that a single certificate covers every case. If your organisation needs the platform to meet a particular standard, that is a conversation we have openly, with evidence, at the scoping stage.