Security Overview

At SENSORAP, we recognize that the physical-world operational data we process—spanning facility environments, critical assets, and spatial utilization—is highly sensitive and central to our customers' operations. Our platform is engineered from the ground up with a security-first architecture designed to ensure the uncompromising integrity, confidentiality, and availability of your data. We employ a defense-in-depth strategy that protects data at the edge, in transit, and throughout our cloud infrastructure.

Protecting Customer Data is our highest priority. We utilize industry-leading cryptographic standards to secure data at every stage of its lifecycle:

• Data in Transit: All data transmitted between edge connected devices, client applications, APIs, and our backend infrastructure is strictly encrypted in transit using TLS 1.2 or higher (with TLS 1.3 preferred), utilizing strong cipher suites equipped with Perfect Forward Secrecy (PFS).
• Data at Rest: All Customer Data stored within our primary databases, analytical data warehouses, and object storage systems is encrypted at rest using AES-256 symmetric encryption. Key management is handled through a secure, centralized hardware security module (HSM) service.
• Cryptographic Isolation: Tenant data is logically isolated at the database and application tiers to prevent cross-tenant data leakage.

Rigorous access controls ensure that only authenticated, authorized users and systems can interact with the SENSORAP platform:

• Role-Based Access Control (RBAC): The platform provides granular, customizable RBAC, allowing Customer administrators to define exact permissions for operators, analysts, facility managers, and system administrators. Access is enforced based on the principle of least privilege.
• Enterprise Single Sign-On (SSO): We support SAML 2.0 and OIDC integrations, enabling Enterprise customers to manage SENSORAP access through their existing Identity Providers (IdP) such as Okta, Azure AD, or Google Workspace.
• Multi-Factor Authentication (MFA): MFA is heavily encouraged for all users and can be strictly enforced at the organizational level by Customer administrators.
• Session Management: Sessions are secured with strict timeout policies, concurrent login restrictions, and anomaly detection to flag impossible travel or suspicious access patterns.

Securing the perimeter where physical sensors interact with our digital infrastructure is a critical component of our security posture:

• Mutual Authentication: Every hardware endpoint and gateway connecting to the SENSORAP ingestion tier must authenticate using unique cryptographic device credentials (e.g., X.509 certificates).
• Zero-Trust Ingress: Unauthorized, unregistered, or revoked devices are automatically rejected at the network edge by our ingress gateways.
• Firmware Integrity: For SENSORAP-managed edge gateways, firmware updates are cryptographically signed and verified before application to prevent malicious tampering.
• Payload Validation: All incoming telemetry packets are strictly validated against expected schemas before being admitted to the processing pipeline. Malformed payloads are quarantined and alerted.

SENSORAP is hosted on top-tier cloud infrastructure providers compliant with global security standards (SOC 2, ISO 27001).

• Network Isolation: Our backend architecture utilizes Virtual Private Clouds (VPCs) with strict network segmentation. Core databases and internal microservices are deployed in private subnets with no direct internet access.
• DDoS Protection: We employ active Distributed Denial of Service (DDoS) mitigation services and Web Application Firewalls (WAF) to defend against volumetric and application-layer attacks.
• Intrusion Detection: Continuous network monitoring, intrusion detection systems (IDS), and automated threat intelligence feeds actively scan for anomalous behavior and known indicators of compromise.

Transparency and traceability are essential for enterprise security and compliance requirements:

• Immutable Audit Logs: We maintain detailed, tamper-evident audit logs of critical system activity, including user logins, RBAC configuration changes, API key generation, and workflow execution events.
• Compliance Export: Audit logs are accessible via the administrative dashboard and can be exported to standard SIEM (Security Information and Event Management) tools for centralized organizational monitoring.
• Vulnerability Management: SENSORAP conducts regular automated vulnerability scans across our code base, container registries, and infrastructure. Critical vulnerabilities are prioritized according to our strict patch management SLA.
• Third-Party Penetration Testing: We engage independent, CREST-certified security firms to conduct comprehensive penetration testing of our application and infrastructure at least annually.

Our developer interfaces are secured to protect programmatic access to your data:

• Token-Based Authentication: Our REST API requires secure, revocable bearer tokens (OAuth 2.0 / JWT) for authentication.
• Rate Limiting & Quotas: Strict rate limiting is enforced on all API endpoints to prevent abuse, scraping, and denial-of-service conditions.
• Webhook Security: Webhooks dispatched by SENSORAP are cryptographically signed, allowing your receiving endpoints to mathematically verify that the payload originated unmodified from SENSORAP.

SENSORAP maintains a formal, documented Incident Response Plan. In the event of a confirmed security incident or data breach affecting Customer Data, we are committed to promptly notifying affected customers without undue delay, providing transparent details regarding the nature of the incident, the data involved, and the mitigation steps being taken, in accordance with applicable legal and contractual obligations.

We value the work of the security research community. If you believe you have discovered a vulnerability in the SENSORAP platform, we ask that you practice responsible disclosure. Please do not exploit the vulnerability or publicly disclose it before we have had a reasonable opportunity to remediate it.

To report a vulnerability, request our SOC 2 report, or inquire about specific compliance frameworks, please contact our Security team:

SENSORAP LLC — Security Operations
Email: support@sensorap.com (Please use PGP encryption for sensitive disclosures if possible)
Subject Line: Security Vulnerability Report / Compliance Inquiry