Security
What we hold, and what we do not
Powoflow is designed for environments where getting this wrong is not a support ticket. Below is how isolation, identity and auditing actually work, and, at the bottom, an unvarnished statement of which certifications we hold. Today that list is short.
Infrastructure
Multi-layered cloud security with isolation at every level.
Multi-Tenant Isolation
Every row is keyed by the tenant that owns it, so isolation is a property of where the data physically sits rather than a filter someone has to remember to apply. There is no query shape that reaches another tenant, even by mistake.
Encryption
TLS 1.3 for everything in transit and AES-256 at rest, with keys held in a managed key store. There is no unencrypted path, not for telemetry, not for video, not for backups.
Hardened Infrastructure
Runs on hardened cloud infrastructure with network isolation, least-privilege access policies and continuous monitoring. We inherit the certifications our infrastructure providers hold; Powoflow itself holds none yet, see Compliance status below.
Authentication & Access
Enterprise identity management with fine-grained access control.
Organisations, ready to federate
Every tenant is created as its own isolated identity organisation with its own users, roles and invitations, which is the structure a corporate directory federates onto. Sign-in today is email and password or Google, and tenant admins bring in their own people. Directory federation is groundwork laid, not yet wired to a customer: raise it early and we will scope it with you.
Role-Based Access Control
Admin, Manager, and Viewer roles. Per-tenant permissions ensure users only see their organization's data.
JWT Validation
RS256-signed tokens with rotating keys. Issuer, audience and expiry are verified on every single request, at the edge, before anything else runs.
Edge Device Security
Hardware root of trust from bootloader to cloud.
Signed Firmware
MCUboot RSA-2048 signed firmware updates. Devices reject unsigned or tampered firmware. Over-the-air updates with rollback protection.
Mutual TLS
Every edge device carries its own X.509 certificate and a policy scoped to its own topics, so one compromised device cannot read another\u2019s traffic. Certificates rotate and revoke individually.
Secure Boot
Hardware root of trust on the Nordic cellular devices, with a verified boot chain from bootloader to application and firmware images signed before they are accepted.
AI & Data Governance
Full accountability for every AI decision and data lifecycle event.
AI Audit Logging
Every AI decision logged to a dedicated audit table. Non-fatal writes ensure operations continue even if logging encounters issues.
Data Retention Policies
Configurable per tenant and subscription tier (7 to 365 days). Automatic TTL cleanup. Archive-before-purge lifecycle.
Audit Trail
Immutable audit logs for all state changes. Tenant-scoped queries with 365-day retention on Enterprise tier.
Compliance status
Most vendor security pages imply more than they hold. This one is a statement of fact as of September 2026, and it will be updated when any line in it changes. If a certification is a hard requirement for you, the honest answer is below rather than in a footnote after a pilot.
| Item | Status | What that means here |
|---|---|---|
| SOC 2 | Actively pursuing | We are working towards it and will announce it once achieved. There is no report to send you today and we will not imply otherwise. |
| ISO 27001 | Actively pursuing | The information security management system is being built out towards certification. We will announce it when we have achieved it and not before. |
| GDPR | Built for and compliant | Tenant isolation, per-tenant purge, configurable retention, consent records and a full audit trail are implemented, and we act as processor on your data under your instructions. Portability export and data-residency selection are designed and not yet built; if either is a hard requirement, raise it early. |
| NIST AI RMF 1.0 · ISO/IEC 42001 | Self-assessed mapping | A documented clause-by-clause mapping with provenance held as evidence. That is our own assessment; no external body has reviewed it. |
| ISA-18.2 · ISO 14224 · ISO 81346 | Implemented | These are engineering standards the product implements. An enforced failure-code vocabulary, a full alarm state machine, resolved reference designations. They are not certifications and nobody audits them. |
| Availability | 99.9% target | We target 99.9% monthly availability and will tell you when we miss it. That is the number we run to rather than a contractual guarantee with credits attached, and we would rather say so than sell you one we cannot yet measure end to end. |
See also our privacy policy and terms.
Security we inherit, and security we add
A great deal of what protects your data is not something we wrote. Data is encrypted in transit and at rest by default rather than as something someone remembered to switch on. Keys are held in a managed key service, not in our code or our config. Every request arrives through a gateway that authenticates it before it reaches anything we built, and network isolation keeps the parts that process your data off the public internet entirely.
We take that as the floor rather than the finish. On top of it sit the things only we can do: tenant isolation enforced at the data layer rather than by a filter in application code, per-device identity and per-device authorisation for everything in the field, an audit record of every action that changes something, and a Field Agent baseline that has to pass before a device is handed over.
Who we build on
We work with our partners to stay current with security standards and best practice, and we follow their hardening guidance ratherthan inventing our own: AWS for the cloud our data sits in,Cloudflare at the network edge, Auth0 for identity, and Nordic Semiconductor for the silicon in the devices we design.
The practical value of that is unglamorous. When one of them publishes an advisory or changes a recommended baseline, it reaches us as a change to follow rather than something we have to discover. Security work that depends on us noticing is security work that eventually gets missed.
Responsible Disclosure
Found a vulnerability? Contact security@powoflow.com. We take every report seriously and aim to acknowledge within two working days.