Skip to content

DeviceBoard – Data Security & Privacy Features Guide

DeviceBoard – Documentation

DeviceBoard – Data Security & Privacy Features Guide

For Self-Hosted / Customer-Owned Cloud or On-Premise Deployments

DeviceBoard is designed with a security-first architecture, enabling organizations to deploy the platform inside their own private cloud, edge data center, or on-premises infrastructure, while maintaining full control over data, access, encryption, and compliance.

This document outlines the security, privacy, and data protection capabilities that DeviceBoard provides by default.

1. Deployment Security Architecture

DeviceBoard can be deployed securely in:

  • Private Cloud (AWS, Azure, GCP, OCI)
  • On-Premise Datacenters
  • Virtualized environments (VMware, Proxmox, OpenStack)
  • Bare-metal high-availability clusters

Customers maintain full control of:

  • Network isolation
  • Storage security
  • Encryption keys
  • Access to logs & audit trails
  • Compliance policies

DeviceBoard’s architecture supports:

✔ Role-isolated microservices
✔ Segregated device data pipelines
✔ Secure API communication
✔ Multi-layer firewall architecture
✔ Tenant/Hub-level access boundaries

2. Data Protection & Privacy Controls

2.1 End-to-End Encryption

DeviceBoard supports encryption at all levels:

In Transit

  • TLS 1.2/1.3 for:
  • MQTT
  • HTTP/HTTPS
  • CoAP DTLS
  • LwM2M over DTLS
  • WebSocket Secure
  • Gateway communication
  • External integrations

At Rest

  • Encrypted database storage
  • Encrypted file storage
  • Optional integration with cloud-native encryption (AWS KMS, Azure Key Vault, GCP KMS)

For Credentials

  • API keys hashed
  • Device tokens encrypted
  • Shared secrets protected
  • Certificates stored using secure vault-like structure

2.2 Zero External Telemetry Flow

  • No data flows to external servers
  • No telemetry is routed to third-party locations
  • All data processing happens inside the customer-controlled environment
  • DeviceBoard does not collect, export, or analyze customer data externally

This is a major requirement for regulated industries such as:

  • Banking & Financial
  • Healthcare
  • Government
  • Energy & Utilities
  • Telecom

2.3 Customer-Owned Data

  • Are stored only in the customer’s infrastructure
  • Remain fully under the customer’s governance
  • Are not accessible by DeviceBoard or third parties
  • Can be sanitized, deleted, or archived per customer policy

DeviceBoard supports:

  • GDPR
  • ISO 27001 principles
  • Data minimization
  • Retention policies
  • Right-to-erasure workflows

3. Access Control & Identity Security

3.1 Hub-Level RBAC (Role-Based Access Control)

Hub Admin defines which application modules each role can access:

  • Devices
  • Assets
  • RulesFlow
  • Dashboards
  • AI Models
  • Reports
  • Alarms & Notifications
  • Firmware Updates

Roles can be granularly customized.

3.2 ABAC (Attribute-Based Access Control)

  • Read/write telemetry
  • Modify attributes
  • Execute RPC commands
  • Manage alarms
  • Edit dashboards
  • Run AI training
  • Access reports

3.3 Device/Asset Group Data Isolation

Users only see devices and assets assigned to their groups.

3.4 Client-Level Isolation

  • Client Admins can manage ONLY their devices and sub-users
  • They cannot access other clients’ data
  • Their users inherit RBAC/ABAC defined by Hub Admin
  • DeviceBoard provides full multi-client isolation

3.5 Integration with External Identity Systems

  • SSO (SAML 2.0, OAuth 2.0, OIDC)
  • LDAP / Active Directory
  • Multi-factor authentication (via SSO providers)

4. Device Authentication & Provisioning Security

4.1 Token-Based Authentication

  • Tokens are encrypted at rest
  • Easily rotated or revoked
  • Can be regenerated anytime

4.2 X.509 Certificate-Based Authentication

  • Mutual TLS authentication
  • PKI infrastructure
  • Custom Certificate Authorities

4.3 LwM2M Secure Bootstrap

  • Secure enrollment
  • Secure key provisioning
  • Credential rotation

4.4 Multi-protocol Secure Authentication

  • MQTT over TLS
  • CoAP with DTLS
  • HTTPs
  • Sparkplug secure sessions
  • Gateway encrypted channels

5. Secure Firmware & Software Management

DeviceBoard includes Secure Device Firmware Update (SDFU):

  • Encrypted firmware storage
  • SHA-256 checksum verification
  • Secure download channels
  • PKI-based signature validation
  • Audit-tracked firmware rollout
  • Staged deployment with rollback
  • Role-based approval flows

This prevents unauthorized or malicious firmware updates.

6. Data Governance & Retention Policies

DeviceBoard provides configurable policies for:

  • Data retention (per device / model / type)
  • Auto-expiration of telemetry
  • Archiving to external storage (S3, Azure Blob, NFS)
  • Granular backup/restore settings

Customers can satisfy internal regulatory or compliance needs.

7. Audit Logging & Compliance Monitoring

DeviceBoard logs:

  • User activity (logins, access, permission changes)
  • Device commands & RPC execution
  • Firmware update actions
  • Alarm lifecycle logs
  • API access logs
  • Configuration changes
  • Errors & exceptions
  • RulesFlow execution logs

Audit logs are:

  • Immutable
  • Exportable
  • Searchable
  • Integratable with SIEM (Splunk, ELK, Azure Sentinel)

8. Network Security & Isolation

8.1 DMZ Deployment

DeviceBoard microservices can be isolated into:

  • Public access zone (API gateway, MQTT brokers)
  • Private/internal zone (database, AI engine, dashboards)

8.2 Firewall & Whitelist Controls

Customers can:

  • Restrict inbound/outbound traffic
  • Permit only specific IP ranges
  • Lock down protocol ports
  • Apply WAF/IDS/IPS products

8.3 No External Callbacks (Unless Configured)

DeviceBoard does not communicate with external endpoints unless:

  • Email/SMS systems are configured
  • External integrations are enabled
  • API connectors are intentionally added

Default behavior is fully isolated.

9. Data Segmentation & Multi-Tenancy Controls

DeviceBoard supports multiple segmentation models:

  • Hub-level dataset isolation
  • Client-level dataset isolation
  • Device-group and asset-group isolation
  • Multi-role feature visibility
  • No cross-access between clients

Perfect for OEMs, service providers, and regulated organizations.

10. High Availability & Disaster Recovery

DeviceBoard supports fully redundant deployments with:

  • Multi-node clustering
  • Load balancing for API & MQTT
  • Failover for database clusters
  • Hot standby capability
  • Automated backups
  • External storage replication

All critical components can be backed up and restored by the customer.

11. Privacy by Design – Built-in Safeguards

DeviceBoard implements multiple privacy principles:

✔ Data Minimization
Store only required telemetry & metadata.

✔ Controlled Data Sharing
No sharing unless configured.

✔ Local-only Data Storage
All data stays inside the customer’s environment.

✔ Configurable Data Masking
Mask sensitive values at:

  • Ingestion
  • Storage
  • Dashboard visualization
  • API output

✔ Data Export Monitoring
Export actions recorded in audit logs.

12. Customer Control & Customization

Since DeviceBoard runs in customer infrastructure:

Customers Control:

  • Who accesses data
  • How long data is stored
  • How backups are maintained
  • Whether data is encrypted with internal KMS
  • Network segmentation
  • Security standards & policies

DeviceBoard Does Not:

  • Collect telemetry externally
  • Backup data outside the customer environment
  • Access device information
  • Send analytics or AI results externally

13. Summary

DeviceBoard offers enterprise-grade, fully self-hosted IoT security & privacy architecture, providing:

✔ Complete customer control over data
✔ End-to-end encryption
✔ Strong RBAC + ABAC
✔ Secure firmware updates
✔ Device-level authentication
✔ Audit logging & compliance monitoring
✔ Isolation of devices, clients & hubs
✔ No external telemetry flow
✔ Secure connectivity across all protocols
✔ Full on-premise or private cloud deployment

DeviceBoard is designed for organizations requiring maximum security, privacy, and regulatory compliance across large-scale industrial IoT deployments.