How a device connects decides how well its data and its commands are protected on the way. Hermetry encrypts device traffic by default and treats every weaker option as an exception you must switch on per device profile. This page collects the transport protections in one place; the field-by-field reference is in Device profiles (tab Transport & auth).
Encryption
| Path | Default | Details |
|---|---|---|
| MQTT | TLS on port 8883 | TLS 1.2 minimum, TLS 1.3 preferred. TLS 1.2 suites with forward secrecy only (no RSA key exchange, no CBC). See MQTT. |
| Device HTTP API | HTTPS | Plain HTTP works only where your installation offers it, and then commands are limited (below). See Device HTTP API. |
| LoRaWAN | LoRaWAN session keys between sensor and network | How each gateway type connects is in LoRaWAN. |
| Polled endpoints and cameras | Hermetry connects out | Credentials are stored encrypted and never shown again. See Protocol endpoints. |
Exceptions you must switch on
| Profile setting | Default | Risk | When to use it |
|---|---|---|---|
| Plain MQTT allowed (port 1883) | Off (TLS only (port 8883)) | Data and credentials travel in clear. | Only for devices that cannot do TLS, on a private network or VPN. Switching back to TLS only ends the plain sessions at once. |
| Token in the URL (devices that cannot send headers) | Off | The token can leak through proxy logs and history. Such a profile is HTTP-only and its devices never receive commands. | Only for devices that cannot set an Authorization header. |
| Commands allowed without TLS | Empty | A listed command can be read or replayed on the way. | Only harmless commands such as sys.info or sys.ping, at most 32. |
Whatever the profile says:
- Commands are sent only over TLS sessions, except the ones listed under Commands allowed without TLS. Other commands wait for a TLS session or their expiry.
- Firmware updates and device settings are never sent in clear, and a factory reset is never sent to a device at all.
- Never list
sys.reboot,ota.checkorcert.renewas allowed without TLS.
Who may connect
| Control | Effect |
|---|---|
| Allowed authentication | The credential types the profile accepts: Access token, MQTT basic (username and password), X.509 certificate. Allow only what your devices use. |
| Allowed networks | Up to 64 IPv4 or IPv6 networks or single addresses. Devices outside are refused (MQTT CONNACK 5, HTTP 403). Use it for devices at fixed sites. |
| Device status | A disabled device, a device of a suspended organisation and a revoked credential are refused at login, and open sessions end at once. |
| One credential per device | Each device has at most one active credential. Secrets are shown once and only a hash is stored. |
| Certificates | A presented client certificate always decides; there is no fallback to a password. See The device certificate authority. |
Use X.509 certificates where the device supports them, then MQTT basic, then access tokens. Rotate secrets when staff who knew them leave. See Device credentials.
Rate limits
Rate limits protect your organisation and the platform from a broken or hijacked device:
| Limit | Default | Over the limit |
|---|---|---|
| Telemetry messages per device | 10 per second, 300 per minute | Acknowledged and dropped |
| Telemetry points per device | 200 per second, 6,000 per minute | Acknowledged and dropped |
| Attribute updates per device | 5 per second, 60 per minute | Acknowledged and dropped |
| Message size | 64 KiB, at most 1,000 key-value points | Dropped whole |
| Whole organisation | From your plan | Acknowledged and dropped; HTTP 429 |
A device that keeps breaking its limit (more than three times its minute allowance dropped within a minute) has its session closed. Owners and admins get one notice per device per hour. The per-device values are set on the profile’s Limits; the organisation’s rates are in Plans and the IoT add-on.
Device addresses
Hermetry records the address a device connects from, to show it on the device and to support investigations. Device addresses are kept 30 days in the connection log and are never part of an export.
Hardening checklist for a profile
- Plain MQTT: TLS only (port 8883).
- Token in the URL: off.
- Commands allowed without TLS: empty.
- Allowed authentication: only the type your devices use; X.509 for licensed devices.
- Allowed networks: the site’s public address or range, where it is fixed.
- Limits: lower them to what the device really sends, so a fault shows quickly.
- Watch the audit log for blocked device logins (for example
iot_gateway.auth_blocked).