Security | Kaiterra

Device Security

Kaiterra devices are engineered to resist physical tampering, remote attack, and supply-chain compromise.

01 No Incoming Connections Once configured, Kaiterra devices do not accept any inbound network connections. All communication is initiated by the device, eliminating an entire class of remote attack vectors.

02 Signed Firmware All firmware updates are cryptographically signed by Kaiterra and verified by the device before installation. The Sensedge Mini and Sensedge Go additionally enforce hardware-backed secure boot, so only verified firmware can ever execute.

03 Hardware-Backed Cryptography on
Sensedge Go Our wireless Sensedge Go is built around a dedicated hardware secure element with a NIST SP 800-90 compliant entropy source. Cryptographic keys are generated and used entirely on-chip — they cannot be read out, even with physical access.

04 Independent Penetration Testing Kaiterra devices are subjected to third-party penetration testing throughout the product lifecycle.

Secure Communications

We employ a Zero Trust approach to all network traffic.

01 Outbound Connections Only Devices initiate every connection outbound to Kaiterra's cloud. They never listen for inbound traffic from the internet.

02 Modern TLS Everywhere All cloud endpoints require TLS 1.2 or higher and support TLS 1.3. TLS 1.0 and 1.1 are explicitly disabled. HTTP traffic is unconditionally redirected to HTTPS. Cipher suites follow the Mozilla intermediate-compatibility configuration and are reviewed quarterly.

03 Signed and Verified Updates Firmware and configuration delivered to devices are signed by Kaiterra and verified by the device before being applied, preventing tampered updates from ever taking effect.

04 BYO MQTT Broker Support Customers can route device data to their own MQTT broker — on-premise or internet-connected — optionally protected with mutual TLS authentication.

05 Network Segmentation Friendly Our devices and gateways operate cleanly on dedicated IoT VLANs, with HTTP proxy support and 802.1x authentication on LoRaWAN gateways for enterprise network environments.

Cloud Security

Kaiterra's cloud is built on AWS with a defense-in-depth architecture and continuous threat detection.

01 EU-Based Infrastructure All customer data is hosted in AWS Frankfurt (eu-central-1). Data never leaves the EU region.

02 Encrypted at Rest, End to End Every storage layer — databases, backups, file storage, container volumes — is encrypted at rest using AES-256. Keys are managed by AWS KMS and stored in hardware security modules (HSMs), with automatic annual rotation.

03 Network Isolation and DDoS Protection Private VPCs, segmented subnets, and least-privilege security groups isolate every tier of the platform. All public endpoints are protected by AWS Shield against volumetric DDoS attacks.

04 Continuous Threat Detection AWS GuardDuty monitors our environment 24/7 for anomalous activity. AWS Inspector continuously scans container images and infrastructure for known vulnerabilities.

05 Hardened Privileged Access Administrative access to production systems is available only through a bastion server using SSH key authentication — root login, password access, and direct production SSH are all disabled. All privileged actions are logged.

06 Comprehensive Audit Logging AWS CloudTrail provides immutable records of all infrastructure activity. Application and access logs are retained for 90 days online and up to 180 days in long-term storage, supporting forensic investigation and customer-facing exports.

Data Privacy and Residency

We treat customer data as a custodian, not an owner. You decide what we keep, how long, and when it's deleted.

01 EU Data Residency

All operational and environmental data is stored exclusively in AWS facilities in Germany. Data does not cross regional boundaries.

02 GDPR Compliant

Kaiterra maintains a GDPR program with a designated Data Protection Officer, a published Data Processing Agreement, and a 72-hour breach notification commitment.

03 Logical Tenant Isolation

Customer data is logically isolated at the application layer. Cross-tenant access is explicitly tested as part of every penetration test.

04 Right to Deletion On request, customer data is securely deleted from production systems and purged from backups within 30 days. Deletion certificates are available.

05 Customer-Configurable Retention Environmental data retention is customer-configurable. By default, sensor data is retained indefinitely, but customers can set their own retention windows or request deletion at any time.

Application Security

Security is considered and threats are addressed throughout our development lifecycle.

01 Injection-Resistant by Design

All database queries use parameterized statements. User input is validated by length, type, structure, and range. Output is sanitized and encoded to prevent cross-site scripting.

02 Browser Security Headers

The Kaiterra Data Platform sets HSTS, X-Frame-Options, and Content Security Policy headers to defend against clickjacking, mixed-content attacks, and code injection in the browser.

03 CSRF Protection

All state-changing requests are protected with anti-CSRF tokens.

04 Rate Limiting Every public endpoint enforces rate limits to prevent abuse and brute-force attempts. Limits can be tuned per customer where higher throughput is required.

05 Secure Development Lifecycle We follow a documented SDLC with strict environment separation. No production data is ever used in development or testing. Non-production environments use synthetic or anonymized data only.

Account Security

Security measures are implemented at every level to protect user accounts and ensure seamless and secure access to the Kaiterra Data Platform.

01 SAML 2.0 Single Sign-On Enterprise customers can authenticate via SAML 2.0 SSO against their existing identity provider, with no Kaiterra-specific credentials required.

02 Two-Factor Authentication (2FA) 2FA is available to all users and can be enforced organization-wide by administrators.

03 Building-Level Role-Based Access Control Granular roles (Organization Owner, Administrator, Building Administrator, Installer, Viewer) let you scope access to specific buildings or campuses rather than entire portfolios.

04 Modern Password Protection Credentials are hashed with a strong, salted algorithm before storage. Password complexity is enforced, accounts are locked after repeated failed attempts, and password reset links expire after 4 hours.

05 Secure Session Management Session tokens are issued as HttpOnly, Secure cookies and rotate automatically. Refresh tokens expire after 7 days or immediately on logout; short-lived access tokens limit the impact of any single token's exposure.

06 Documented Joiner/Mover/Leaver Process We provision and deprovision access for our own employees through a documented JML process, with quarterly access reviews and immediate revocation on departure.

API Security

Kaiterra’s API is designed with robust authentication mechanisms to ensure secure access and data consumption.

01 API Key Authentication API access uses revocable API keys, which inherit the role and scope of the user that created them.

02 HTTPS Required All API traffic requires TLS 1.2 or higher. HTTP requests are unconditionally redirected.

03 Rate Limiting Default rate limits apply to all API keys and can be tuned per customer based on integration requirements.

04 Comprehensive Request Logging Every API request is logged with source IP, timestamp, endpoint, response code, and latency, supporting both performance monitoring and security auditing.

Resilience and Recovery

Kaiterra's platform is built to keep your data safe, available, and recoverable.

01 Continuous Backups Customer metadata is continuously backed up; environmental sensor data is backed up daily. All backups are encrypted.

02 Online and Offline Backup Tiers

Online backups are retained for 30 days. Offline backups are stored in a separate AWS account and retained for 180 days, isolating them from the production environment.

03 Quarterly Recovery Testing We test our restore procedures every quarter to verify backups are usable and our recovery time objectives are achievable.

04 24/7 Monitoring The platform is monitored around the clock with multi-channel alerting (Slack, phone, email). On-call engineers respond to incidents at any hour.

Compliance and Trust

We invest in the policies, programs, and coverage that enterprise security teams expect.

01 Independent Penetration Testing Both our hardware and cloud platform undergo regular third-party penetration testing. Reports are available to customers under NDA.

02 Defined Vulnerability Remediation SLAs

Critical and high-severity findings are remediated within 30 days. Medium findings within 90 days. Zero-days trigger an immediate assessment and patch cycle.

03 Quarterly Patching Cadence Operating systems, runtimes, dependencies, and platform components are patched every quarter, with a 7-day window for critical patches.

04 Cyber and Professional Indemnity Insurance Kaiterra maintains USD 5 million in combined cyber and professional indemnity coverage through CFC Underwriting, covering breach response, forensic investigation, and third-party liability.

05 72-Hour Breach Notification We commit to notifying affected customers and regulators within 72 hours of becoming aware of a security incident, in line with GDPR requirements.