Skip to content

Cookie preferences

We use cookies for our own analytics, to see how our campaigns perform and, if you allow it, to load content from other services such as the Google site search. We never sell your data. Necessary cookies keep the site working and cannot be switched off. See our Cookie Policy for details and our Privacy Policy for how we handle personal data.

Security, load balancing and remembering your cookie choice.

Show us which pages people read, how they find the site and where they get stuck, so we can improve it (Google Analytics, Microsoft Clarity).

Show us which of our ad campaigns bring visitors to the site and remember the campaign or partner link you arrived from (Google Ads, LinkedIn, Meta, partner program). We do not use these cookies to build advertising profiles.

Load the site search from Google when you use it. Google sets its own cookies and shows ads in the search results.
© 2026 The ThingsBoard Authors
22.5k Try for free

ThingsBoard Cloud

Choose your data region

Your data stays in the region you choose, for residency and compliance. No credit card required.

North America Data stored in North America Europe Data stored in the European Union

Rather run it yourself? Install on your own servers

Access control

Who can sign in, what each user can see, and a record of what they did. We built these controls into the platform; you decide how strictly to apply them in your tenant.

  • Two-factor authentication

    TOTP authenticator apps, email, SMS and backup codes. System administrators set the platform policy, and tenant administrators can apply their own. From version 4.3, you can require 2FA for all users, for system administrators only, or for tenant administrators of selected tenants. Code lifetime, resend limits and lockout after failed attempts are configurable.
    Documentation

  • Single sign-on

    OAuth 2.0 and OpenID Connect with Google, Auth0, Keycloak, Okta, Azure AD and other identity providers, so account lifecycle stays in your directory. SAML and LDAP are not supported.
    Documentation

  • API keys

    Long-lived credentials for integrations, scripts and automation, so you don't share a user's password.
    Documentation

  • Role-based access control

    Roles and entity groups scope each user to their own devices, assets and dashboards: a customer, an operator and an analyst each see only what belongs to them.

  • Session lifetimes

    Configurable
    You set how long access and refresh tokens (JWT) stay valid. The defaults are 2.5 hours and 7 days; we recommend shortening both.
    Documentation

  • Audit log

    The platform records user actions in an audit log. On-premises you can forward it to Elasticsearch; in every deployment you can read it through the REST API.
    Documentation

  • Password and lockout policy

    Configurable
    Minimum length, complexity and lockout after failed attempts, set by the administrator.
    Documentation

  • Password expiration

    Configurable
    You can make passwords expire after a set period if your policy requires it. NIST SP 800-63B advises against scheduled rotation, so we recommend it only where a regulator asks for it.
    Documentation

Read next

Can’t find what you need?

Our security team answers questions, shares documents under NDA and handles vulnerability reports.