Privacy and security

A home product has to earn trust.

This page lists what is implemented in the working demo today. We do not claim certifications or audits. If and when we have them, they will be named here with the report.

Architecture

The request path and where each control sits.

01 · Household

Browser or phone

Session cookie (httpOnly, SameSite)
CSRF token on every write
Theme is the only other cookie

02 · Edge

Transport and browser policy

TLS and HSTS (over HTTPS)
Content-Security-Policy with nonces
Frame denial, no MIME sniffing
Rate limits on sign-in and forms

03 · Application

Household-scoped access

Owner and member roles
Queries keyed to the caller’s household
Staff roles cannot open energy data
Strict schema validation

04 · Data

Storage and evidence

Parameterised statements only
argon2id credential hashes
Tamper-evident activity log
Export your data from Settings

The trust boundary starts at the edge. Everything to its right is checked on the server, whatever the interface shows.

Controls

Implemented in the demo today.

Passwords

Hashed with argon2id and a unique salt. Sign-in attempts are rate limited and accounts lock briefly after repeated failures.

Sessions

Random tokens in httpOnly, SameSite cookies, stored only as hashes. Sessions expire when idle, and end when a password changes or an account is paused.

Roles enforced on the server

Owners, members and staff have different permissions checked on every request. Staff cannot read household energy data.

Request protection

CSRF tokens and origin checks on every change, strict input validation, parameterised queries, and a content security policy with per-request nonces.

Activity log

Sign-ins, device changes and decisions are recorded in a hash-chained log, so tampering is detectable.

Your data, your call

Export your account, devices, goals and 90 days of energy data from Settings at any time.

The demo runs on fictional households with a simulated energy model. It has no connection to real meters, inverters or utilities. A public launch would add multi-factor sign-in, email verification and an independent security review.

Compliance posture

Implemented, planned, and not claimed.

We would rather be precise than impressive. Treat Wattlark as pre-assessment software.

Control area	Status	Detail
Credential storage	Implemented	argon2id with unique salts; lockout after repeated failures.
Household isolation	Implemented	Every household query is keyed by the signed-in user, never by an id from the client. Covered by automated tests.
Staff access to energy data	Implemented	Support roles can manage access and read the audit trail but have no permission to open household usage.
Activity log	Implemented	Hash-chained entries for sign-ins, switches and applied suggestions.
Data export	Implemented	Owners and members can download their data from Settings.
Two-factor sign-in	Planned	Time-based one-time passwords and passkeys before general availability.
Independent security review	Planned	A third-party test is scheduled before real households are onboarded.
SOC 2, ISO 27001 or similar	Not claimed	No certification or attestation has been completed. None is implied.