Skip to content

Cookie preferences

We use cookies for our own analytics, to see how our campaigns perform and, if you allow it, to load content from other services such as the Google site search. We never sell your data. Necessary cookies keep the site working and cannot be switched off. See our Cookie Policy for details and our Privacy Policy for how we handle personal data.

Security, load balancing and remembering your cookie choice.

Show us which pages people read, how they find the site and where they get stuck, so we can improve it (Google Analytics, Microsoft Clarity).

Show us which of our ad campaigns bring visitors to the site and remember the campaign or partner link you arrived from (Google Ads, LinkedIn, Meta, partner program). We do not use these cookies to build advertising profiles.

Load the site search from Google when you use it. Google sets its own cookies and shows ads in the search results.
© 2026 The ThingsBoard Authors
22.5k Try for free

ThingsBoard Cloud

Choose your data region

Your data stays in the region you choose, for residency and compliance. No credit card required.

North America Data stored in North America Europe Data stored in the European Union

Rather run it yourself? Install on your own servers

Security, compliance and privacy

Trust Center

Security is built into every layer of ThingsBoard, from device connections to the way we develop and run the platform. Your data stays isolated, encrypted in transit and under your control.

Contact us Browse documents

Found a vulnerability? Report it privately

Last updated · Reviewed at least every six months

Maintained by Oleh Reutskyi (opens in a new tab) , IMS Manager

Compliance

Independently verified security

  • ISO/IEC 27001:2022 — certified
  • ISO 9001:2015 — certified
  • GDPR and CCPA, self-declared

Data security

Your data stays protected

  • Tenant isolation by architecture
  • Encrypted in transit with TLS
  • Region of your choice: North America or EU (Cloud), plus APAC (Private Cloud)
  • Export anytime via API, no lock-in

Product security

Security built into the product

  • Encrypted device connections
  • X.509 device credentials and mutual TLS
  • AES-256 encrypted secrets storage

Access control

You decide who sees what

  • 2FA enforceable for all users
  • SSO with OAuth 2.0 and OpenID Connect
  • Role-based access with entity groups

Dev security

Built through a secure process

  • Mandatory code review before merge
  • Weekly code and dependency scanning
  • Annual external penetration test

Our commitments

What we promise and what we handle

  • NDA documents within two business days
  • Support response times for every plan
  • Private Cloud uptime SLA up to 99.95%

Deployments

Whether you use ThingsBoard Cloud, Private Cloud or run the platform on-premises, you get the same security features and the same engineering practices behind every release.

ThingsBoard Cloud and Private Cloud

We host and run the platform, so you can focus on your solution.

We run
We host and operate everything: infrastructure, patching, upgrades, monitoring and backups.
Isolation
Cloud: every request is confined to its own tenant.
Private Cloud: a dedicated single-tenant cluster.
Region
Cloud: North America or EU.
Private Cloud: North America, EU or APAC.
Encryption
TLS in transit: HTTPS on 443, MQTTS on 8883.
Backups
Cloud: daily, with point-in-time recovery.
Private Cloud: nightly, in a separate cloud region.
Staff access
Authorized engineers only, and only to handle your request; role-based and logged.
Learn more

On-premises

You run the platform; we provide the product code, security fixes and guides.

You run
Infrastructure, network, patching, backups and recovery.
Built in
2FA, SSO, RBAC, an audit log, and X.509 with mutual TLS for devices.
Guides
Step-by-step security configuration for every feature in the documentation.
Security fixes
Patch releases with no environment or database changes; fixed CVEs listed in release notes.
Support period
LTS releases: 18 months. Standard releases: 6 months.
Learn more

Documents

Public documents are open to everyone. Documents that describe our weak spots, such as the Statement of Applicability and the pentest summary, are shared under a mutual NDA.

Governance & compliance

Security policies

Legal & privacy

Reports & resilience

All 26 documents

Trust Center FAQs

Email security@thingsboard.io for security, compliance and privacy questions and vulnerability reports, and ims@thingsboard.io for document requests.

Within two business days after we sign a mutual NDA. We can also give you the information you need to complete your own security questionnaire.

Email security@thingsboard.io, using our vulnerability report template. We reply within three business days with an investigation plan. Please don't open a public issue: it puts other users at risk before a fix is available.

ISO/IEC 27001:2022 and ISO 9001:2015. Swiss Approval North America issued both certificates on 9 September 2026; they are valid until 8 September 2027, with an audit every year. You can verify them at swissapproval.ch/certificate-validator.

Our management system: how we design, develop, maintain and support the software, our cloud services, QA testing and licensing. It covers how we build and run ThingsBoard, not a customer's own installation.

Yes. You can use our ISO certificates as supplier evidence in your own audit, for example for ISO/IEC 27001, and under NDA we share the Statement of Applicability and audit reports. The platform already covers many of the controls, such as access control, the audit log and the choice of data region, so you don't need to build them from scratch.

ThingsBoard is certified to ISO/IEC 27001 and ISO 9001. The data centers behind ThingsBoard Cloud and Private Cloud hold SOC 2, ISO 27001 and PCI DSS attestations; AWS publishes them in AWS Artifact.

Yes. We meet both through our own privacy program and declare our compliance. When we process data on your behalf, the Data Processing Agreement applies. Send data subject requests to security@thingsboard.io.

ThingsBoard Cloud runs on AWS in two independent regions, North America (thingsboard.cloud) and the EU (eu.thingsboard.cloud), and data never moves between them. Private Cloud runs on AWS by default, or on Azure or GCP on request, in North America, the EU or APAC.

In ThingsBoard Cloud, every request is confined to its own tenant, and customers and entity groups narrow access further. Private Cloud is a dedicated single-tenant cluster.

ThingsBoard Cloud is backed up daily, with point-in-time recovery. Private Cloud takes nightly snapshots and stores them in a separate cloud region for 7 days by default (longer on Enterprise).

Private Cloud has a contractual SLA: 99.9% on Launch and Growth, 99.95% on Scale and Enterprise, and a custom SLA on Enterprise on request.

Only authorized ThingsBoard engineers can access the infrastructure, with regular audits and monitoring. They work with your tenant's data only to handle a request you raised, and that access is role-based and logged.

Yes. Depending on your plan, we set up a dedicated VPN tunnel to your systems. On request, we also provide read-only access to metrics and Kubernetes dashboards under an NDA.

In ThingsBoard Cloud, you export your data through the REST API, and we delete your tenant after cancellation. In Private Cloud, we prepare a full encrypted PostgreSQL/Cassandra dump; you have 60 days to download it, and then we permanently delete all backups and cluster data.

You run the infrastructure, network, patching, backups and recovery, and you keep full control over them. We are responsible for the product code, security fixes and the guides that help you configure the platform securely.

Security fixes ship in maintenance and patch releases of your release line. They need no upgrade script: ThingsBoard applies any database changes in the background after startup. Fixed CVE IDs are listed in the release notes. For production, use the latest LTS line and pin a tag such as 4.4.0-latest to receive patches automatically.

Only for licensing: the platform checks its license every hour over an outbound connection to license.thingsboard.io. Perpetual licenses can use the offline licensing add-on instead.

In the Security section of the documentation: password and lockout policies, 2FA, OAuth 2.0, API keys, TLS for every protocol, the audit log and secrets storage.

Users and devices connect over TLS (HTTPS on 443, MQTTS on 8883, DTLS for CoAP and LwM2M). The platform encrypts stored secrets with AES-256 and stores user passwords as BCrypt hashes.

Yes. 2FA supports authenticator apps (TOTP), email, SMS and backup codes, and from version 4.3 you can require it for all users, for system administrators or for tenant administrators. Single sign-on works over OAuth 2.0 and OpenID Connect with Google, Azure AD, Okta, Keycloak, Auth0 and others. SAML and LDAP are not supported.

We don't use customer data to train or improve ThingsBoard's own AI models. ThingsBoard Cloud can use third-party AI services, for example for development automation and automated support. Data shared with them is used to provide the functionality you request, and the providers are bound by obligations no less strict than our DPA (Terms of Use, 3.13). Our own use of AI follows a dedicated policy aligned with GDPR, the EU AI Act and the NIST AI RMF.

The full list, with purpose and location for each vendor, is on the sub-processors page.

Can’t find what you need?

Our security team answers questions, shares documents under NDA and handles vulnerability reports.