Security
Security built into every device connection
Firmcraft is a multi-tenant IoT platform, so every device, reading and user is tied to a tenant, and every request is scoped to it. This page describes the controls that are in the product today.
Device identity with X.509 certificates
Each device and gateway can be issued its own X.509 client certificate, signed by the platform certificate authority. A certificate identifies exactly one device, so a leaked credential affects one device and not the fleet.
- Per-device and per-gateway certificates issued from the dashboard
- Certificate regeneration when a device is replaced or re-flashed
- A published certificate revocation list (CRL) so revoked devices are refused
Encrypted transport
- MQTT over TLS on port 8883, with mutual TLS using the device certificate
- HTTPS telemetry ingest, with optional client-certificate authentication
- The web dashboard and API are served only over HTTPS
- Firmware images are delivered to devices over HTTPS, and firmware management in the dashboard is scoped to your tenant
Tenant isolation
Telemetry, devices, alerts and firmware records carry a tenant identifier, and every query is scoped to it. Users only ever see the devices and data that belong to their organisation.
Access control and accountability
- Role-based access control with Super Admin, Admin, User and Viewer roles
- Read-only Viewer accounts for customers, auditors and shift staff
- Email verification for new accounts, and Google sign-in
- Token-based authentication at a single API gateway, with rate limiting
- Audit logs of user actions, available to administrators
Frequently asked questions
Can one customer see another customer’s devices?
No. Every device, reading and alert is stored with a tenant identifier and every request is filtered by it, so users only see their own organisation’s data.
How do devices authenticate?
Devices can use a unique X.509 client certificate issued by the platform and connect over MQTT with mutual TLS. Revoked certificates are published on a certificate revocation list.
Is there an audit trail?
Yes. User actions are written to an audit log that administrators can review from the dashboard.
Start on the free plan
Create an account and connect your first device in minutes, or talk to us about a larger rollout.