Security Overview
Last Updated: 2026-02-27
1. Hosting
The Twinise platform runs on managed cloud infrastructure — a managed Kubernetes cluster and a managed Postgres database, operated by DigitalOcean. Telemetry is stored as structured rows in that database.
2. Transport Security
- Platform APIs and client streams run over TLS. The WebSocket feed the Unreal connector consumes is served over the same secured path.
- Device MQTT transport is not yet TLS-secured. Broker TLS is planned.
3. Access and Tenancy
- Each device is issued its own access token when it is registered. That token is the device's credential for publishing telemetry, and nothing else accepts it.
- People sign in with an email address and a password, and hold a short-lived access token alongside a longer-lived refresh token. API-key access is planned.
- Every resource is bound to an organization, and every query is filtered by it. The organization is the isolation boundary.
4. Certification Status
Twinise holds no security certification today. Formal certifications — ISO 27001, SOC 2 — and independent penetration testing are on our roadmap and not yet in place. We would rather tell you that than let a badge imply otherwise.
5. Evidence and Benchmark Context
For how the system is put together, and how any performance figure should be read:
Performance figures are published only where they can be measured and labelled. The methodology page sets out the labels we use and the metadata each one carries; treat any number not published under it as illustrative.