Security & Compliance
As a turnkey solution provider in smart home, securing connected devices, data and services is a major focus for Arnoo
Security Controls
Arnoo's "full stack" security philosophy employs a wide range of leading edge security measures focused on user authentication, transmission, and intrusion prevention. These security measures include:
- Devices authenticated with a unique key pair
- Encrypted LAN Mode communication between mobile application and device
- Data encryption - HTTPS encrypted with TLS, UDP channel with AES-128 encryption
- Layered access control to prevent breaches of one device compromising the whole system
- Penetration tests by 3rd party vendor
Data Access Controls
Connected products and the data they generate will typically be accessed by a variety of different individuals, including friends or family, customer support teams, product operation teams, business analysts, and more. To ensure the right people have access to the appropriate data, Arnoo provides a wide range of access controls. These controls include:
- Role Based Access (RBAC) framework to define custom roles and access permissions for device and user data (for both the OEM organization and external parties)
- Secure sharing of devices among family members or guests
- End-user can opt-in to share their device data with partner services, such as energy management or replenishment services
- Layered access control to prevent breaches of one device compromising the whole system
- Tracking of data access for auditing and compliance purposes
Data Privacy Controls
Maintaining the privacy of consumer data is a growing concern world-wide. Arnoo supports our customers in their commitment to enable the highest level of privacy standards for their market with a strong set of privacy tools. These include:
- Role Based Access (RBAC) framework to define custom roles and access permissions for device and user data (for both the OEM organization and external parties)
- Data ownership tied to registered owner of the device with role-based access for OEM staff
- GDPR-ready Dashboard UI to protect access to personally identifiable information (PII)
Infrastructure Security
Securing customer data and their virtualized devices from malicious attacks or theft is a major focus of the Arnoo security team. We deploy a number of leading edge security measures across the various cloud infrastructure providers that our platform runs on (e.g., AWS, Azure). These measures include:
- ll services deployed within a VPC, with service and databases installed in different subnets
- Compute instances not directly accessible from the internet and run intrusion detection systems
- GFirewalls to protect services at the network level
- DDoS filters and web application firewalls employed
Certifications and Compliance Certificates
To ensure our security practices adhere to the highest levels of quality and depth, Arnoo maintains various certifications and annual audits. These certifications include
Quality Management Systems ISO 9001
Information Security Management ISO 27001
Cloud Security ISO 27017
Cloud Privacy ISO 27018
GDPR privacy protection compliant
