Security

Network exposure

• The integration only makes outbound Modbus TCP connections to the configured host and port. It does not listen on a port.
• Modbus TCP is unencrypted and has no authentication. Put devices and Home Assistant in a trusted network segment; never expose port 502 to the internet.
• The optional licence server connection uses HTTPS.

Secrets

• No account passwords are collected or stored.
• Licence blobs are stored in Home Assistant's .storage; they are signed documents, not secrets, but they contain the customer name and instance id.
• The private licence key never belongs in this repository. Use Infisical or Vault and restrict access to release/support staff.
• Support tokens are passed to the provider in memory and are never logged or persisted.

Licence integrity

• Ed25519 signatures cover the canonical JSON payload.
• The instance id is part of the signed payload, so a licence cannot be moved to another installation by copying files.
• The integration re-verifies the stored blob on every start. A tampered or key-rotated blob is discarded and the status sensor falls back to trial/free.

Support access

• Off by default and client-initiated only.
• Maximum session length is 24 hours; the default is 4 hours.
• The session ends on timeout, on manual stop and on Home Assistant restart.
• Version 0.1.0 does not open a tunnel. A future provider must not persist tokens and must close the tunnel in async_stop.

Diagnostics

• Redacts keys containing password, token, secret, api_key or private.
• Contains the Home Assistant instance id, host addresses and register values. Review the payload before sharing it.
• No upload happens in 0.1.0; export_diagnostics only returns data locally.

Reporting a vulnerability

Contact SpeicherGuru GmbH through the ticket system and do not open a public issue for security problems.