Skip to content

Cookie preferences

We use cookies for our own analytics, to see how our campaigns perform and, if you allow it, to load content from other services such as the Google site search. We never sell your data. Necessary cookies keep the site working and cannot be switched off. See our Cookie Policy for details and our Privacy Policy for how we handle personal data.

Security, load balancing and remembering your cookie choice.

Show us which pages people read, how they find the site and where they get stuck, so we can improve it (Google Analytics, Microsoft Clarity).

Show us which of our ad campaigns bring visitors to the site and remember the campaign or partner link you arrived from (Google Ads, LinkedIn, Meta, partner program). We do not use these cookies to build advertising profiles.

Load the site search from Google when you use it. Google sets its own cookies and shows ads in the search results.
© 2026 The ThingsBoard Authors
22.5k Try for free

ThingsBoard Cloud

Choose your data region

Your data stays in the region you choose, for residency and compliance. No credit card required.

North America Data stored in North America Europe Data stored in the European Union

Rather run it yourself? Install on your own servers

Dev security

How we build, test and release the software you run. These practices come from years of delivering production IoT solutions on our own platform.

  • Code review and protected branches

    Every change is reviewed before merge, and branch protection keeps unreviewed code out.

  • Separate environments

    Development, test and production run separately, and production data is never used in tests.

  • Code analysis (SAST)

    Snyk Code scans LTS branches every week.

  • Dependency scanning

    Snyk Open Source checks third-party dependencies every week.

  • Container scanning

    Docker Scout and Snyk Container scan our container images.

  • Change management

    Changes are requested, assessed and approved and tracked in Jira; minor changes follow a shortened path.

  • Independent penetration testing

    An external tester checks the platform every year, following OWASP, OSSTMM and NIST SP 800-115. The latest test, by DataArt, ran in February 2026, with a retest in March 2026.

  • Security fixes and CVEs

    Security fixes ship in maintenance and patch releases, which need no upgrade script. Fixed CVE IDs are listed in the Security section of the release notes.
    Documentation

  • Release support

    LTS releases are supported for 18 months, standard releases for 6 months.
    Documentation

Read next

Can’t find what you need?

Our security team answers questions, shares documents under NDA and handles vulnerability reports.