This section explains the security controls of Hermetry and how to use them well. It is written for administrators, security officers and integrators who must answer “how is this protected?” and “what should we switch on?”. Each page says what is built, what you can set, and what to watch.
The layers
| Layer | What protects it | Page |
|---|---|---|
| Your organisation’s data | Isolation per organisation in the database, separate regions, encrypted secrets, least privilege for every process | How Hermetry protects your data |
| People signing in | Passwords with rules and lockout, passkeys, two-step verification, single sign-on, sessions you can end | Two-factor sign-in and passkeys, Single sign-on, Sessions, lockout and trusted devices |
| What people may do | Roles, groups, access policies | Groups and permissions, Access policies |
| Devices | Factory identity, claiming, certificates from Hermetry’s own authority, TLS, allowed networks, rate limits | The device certificate authority, Device identity and claiming security, Device transport security |
| Programs | API keys with narrow permissions, networks, expiry and rotation | API key hardening |
| Attacks and misuse | The AI firewall, decoys, rate limits and address bans | The AI firewall |
| Evidence | A hash-chained audit log | What is audited, Audit log |
| Personal data | Data-subject requests, erasure, retention | Privacy and data erasure |
A security checklist for a new organisation
- Give every owner and admin a passkey, plus a backup passkey. See Two-factor sign-in and passkeys.
- Turn on Require two-step verification for every member under Settings > Sign-in Policy once everyone has a second factor.
- Keep at least two owners or admins, and give field staff the User role with the IoT operator group.
- Keep every device profile on TLS only (port 8883), and list allowed networks for fixed sites. See Device transport security.
- Create API keys with the Read only preset where possible, an allowed network, and an expiry. See API key hardening.
- Set the audit log retention your compliance rules need, and subscribe to the
audit.high_riskwebhook. - Review the AI firewall’s Security incidents once a week. See The AI firewall.
Reporting a vulnerability
If you believe you found a security problem in Hermetry, contact us through the contact page. Our team also answers security questionnaires.