Non-Disclosure Agreement
Standard NDA for customer, partner, and procurement discussions. Available for immediate download from the Legal & Procurement Documents page.
Platform Trust & Transparency
Built on a Foundation You Can Trust.
Enterprise and government buyers need to understand exactly how their security platform is built, what data it collects, and how that data is protected. IoT Secure is committed to architectural transparency, responsible data handling, and verifiable security controls — because trust is earned through openness, not assertions.
Architecture
How the Platform Is Built
Deployment Models
IoT Secure is available as a cloud-hosted SaaS platform, on-premise deployment for air-gapped or highly regulated environments, and hybrid configurations that keep sensitive data on-premise while using cloud services for management and reporting. The deployment model is selected to match your data residency and compliance requirements.
Sensor Architecture
Network discovery is performed by lightweight IoT Secure appliances (IoT-mini and IoT-max) deployed on your network segments. These appliances observe network traffic passively and transmit only processed metadata — not raw traffic content — to the IoT Secure platform. All sensor-to-cloud communication is encrypted in transit.
Multi-Tenant Isolation
IoT Secure's platform architecture provides true multi-tenant isolation. Customer data is logically separated at every layer — database, storage, compute, and API. Customer environments cannot see, access, or affect other customers' data under any circumstances.
Data Flows
Network sensors collect metadata from your network and transmit it encrypted to the IoT Secure analysis platform. Analysis, scoring, and enforcement recommendations are generated in the platform and presented through the web interface and API. No raw traffic content leaves your network.
Data Privacy
What We Collect — and What We Don't
What We Collect by Default
By default, IoT Secure collects only the network metadata necessary for device discovery and security analysis: MAC address, IP address, open ports, hostname, and protocol usage. This information would be useless to an attacker who does not already have network access — and is insufficient to reconstruct any user communications or sensitive content.
What We Never Collect
IoT Secure never captures, stores, or transmits packet content, email content, user communications, document content, PHI, PII, financial records, or authentication credentials. No SPAN ports or traffic mirroring is required or used.
Optional Enhanced Data
Optional DNS, DHCP, and NetFlow log collection can be enabled to improve device profiling accuracy and enable behavior-based monitoring. These options are configured explicitly by customer administrators and are never enabled by default.
Data Retention Controls
Customer administrators control data retention periods for their environment. IoT Secure does not retain customer data beyond the configured retention period. Upon account termination, customer data is deleted according to the documented data deletion process.
Security Controls
How Your Data Is Protected
-
Encryption in Transit All data transmission between sensors, the platform, and user browsers uses TLS 1.2 or higher. TLS 1.0 and 1.1 are disabled.
-
Encryption at Rest Customer data is encrypted at rest using AES-256 encryption in cloud storage and database systems.
-
Role-Based Access Controls Access to customer data within the platform is controlled by role-based permissions. Administrative access is restricted to specific authorized personnel.
-
Multi-Factor Authentication MFA is required for all administrative access to the IoT Secure platform infrastructure and internal systems.
-
Comprehensive Audit Logging All user actions, API calls, administrative operations, and system events are logged with timestamp, user identity, and action context.
-
Vulnerability Management Program IoT Secure maintains an active vulnerability management program including regular third-party security assessments.
-
Incident Response Plan A documented incident response plan addresses detection, containment, notification, and recovery procedures for security events.
-
Business Associate Agreement (BAA) Available IoT Secure executes BAAs with covered entities and business associates under HIPAA. Download from the Legal & Procurement Documents page.
Enterprise Procurement
Documentation for Your Security Review
Business Associate Agreement
HIPAA BAA for covered entities and healthcare customers. Available for immediate download and execution.
Security & Privacy Policy
Detailed documentation of IoT Secure's security controls, data handling practices, and privacy commitments for security review and vendor assessment questionnaires.
End User License Agreement
The complete EULA governing use of the IoT Secure platform and services. Available for download and legal review prior to purchase.
Ready to begin your security review?
Download procurement documentation or speak with our team about your specific requirements.