Security
What we hold, and what we do not
Where your data is kept, who can see it and how it is protected, in plain terms first. The detail follows, and at the bottom is a statement of which certifications we hold. Today that list is short.
In plain terms
Seven answers before the detail.
Where your data is kept
In the United States, wherever you are. If you are in the European Economic Area, including Norway, your data is transferred there under the European Commission's Standard Contractual Clauses.
Kept separate
Each workspace's data is kept separate from every other workspace's.
Who can see it
The people in your workspace, and our staff when they support the service. We do not sell it or share it with advertisers.
Encrypted
Data is encrypted on its way to us and where it is stored.
Signing in
Sign-in is handled by a specialist identity provider, not by software we wrote ourselves.
How long, and getting it out
Records are kept for as long as your workspace exists. You can export work orders yourself. Ask us for your asset records, or to delete your data, and we will do it. Copies in our event archive expire after up to 30 days.
What we do not hold
No security certification and no uptime commitment yet. The table under Compliance status says exactly where each one stands.
Sign-in and access
Who can sign in, and what they can do.
Your own people, invited by you
Each workspace has its own users, roles and invitations, and workspace administrators invite their own people. Sign-in today is email and password or Google. Connecting your company directory is not available yet: raise it early and we will scope it with you.
Two roles
A person in a workspace is an administrator or a viewer. Finer permissions, per module or per record, are not available yet.
Devices and encryption
Every device has its own identity.
Sensors join with their own keys
Each LoRaWAN sensor and tracker joins the network with a key of its own, and its radio messages are encrypted. That is how the LoRaWAN standard works.
Gateways with their own certificate
Each gateway, including every Powoflow Sense Mesa, has its own certificate and connects to the cloud over TLS with it. One gateway can be removed without touching any other.
Encryption, link by link
AES-128 over the LoRaWAN radio, TLS from every gateway to the cloud, and AES-256 at rest, with keys held in a managed key store. Equipment wired to a gateway on your own network, such as Modbus, carries no encryption of its own and is as private as that network.
Firmware
Off-the-shelf sensors and gateways run their manufacturer's firmware and are updated through it.
Compliance status
A statement of fact as of November 2026, updated when any line in it changes. If a certification is a hard requirement for you, the answer is here.
| Item | Status | What that means here |
|---|---|---|
| SOC 2 | Actively pursuing | We are working towards it and will announce it once achieved. There is no report to send you today and we will not imply otherwise. |
| ISO 27001 | Actively pursuing | The information security management system is being built out towards certification. We will announce it when we have achieved it and not before. |
| GDPR | Built for it | Workspaces are kept separate, we delete data on request, and we act as processor on your data under your instructions, with a data processing agreement available on every plan. A full export of your data and a choice of where it is stored are not built yet; if either is a hard requirement, raise it early. |
| ISA-18.2 · ISO 14224 | Not certifications | Engineering standards we take our vocabulary from: alarms are raised, acknowledged and cleared, and a corrective work order can record what failed and why. Nobody audits us against them. |
| Availability | No SLA yet | There is no contractual uptime figure or service credit today, and we will not quote a number we cannot yet measure. If an uptime commitment is a hard requirement, tell us and we will scope it with you. |
See also our privacy policy and terms.
Who we build on
We build on three large providers and follow their guidance:
- AWS, for the cloud our data sits in, in US regions.
- Cloudflare, in front of the website and the API.
- Auth0, for sign-in.
Each holds its own certifications. Those are theirs, not ours.
The full list of sub-processors is in section 14 of our privacy policy.
Responsible disclosure
Found a vulnerability? Contact security@powoflow.com. We read every report and aim to acknowledge within two working days.