On-premises
You run the platform on your own infrastructure and keep full control over it. We are responsible for the product code, security fixes and the guides below. Our certificates cover how we build and support the software; your installation is your own scope.
| Topic | Details |
|---|---|
| You run | Infrastructure, network perimeter, OS and database patching, platform upgrades, TLS certificates, backups, high availability and recovery. |
| Built into the product | 2FA, OAuth 2.0 single sign-on, role-based access control, API keys, an audit log, AES-256 secrets storage, and X.509 certificates with mutual TLS for devices. |
| Security fixes | Maintenance and patch releases of your release line, with no upgrade script: database changes apply in the background after startup. Fixed CVE IDs are listed in the release notes. Pin a tag such as 4.4.0-latest to receive patches automatically. |
| Release support | LTS releases: 18 months. Standard releases: 6 months. For production, use the latest LTS line. |
| Network requirements | An outbound connection to license.thingsboard.io for the hourly license check. Perpetual licenses can use the offline licensing add-on instead. |
Security configuration guides
- Password, lockout and session settings
- Two-factor authentication
- OAuth 2.0 single sign-on
- API keys
- HTTPS for the web UI and REST API
- Custom domains
- MQTT transport security
- HTTP transport security
- CoAP transport security
- LwM2M transport security
- SNMP transport security
- Audit log
- Secrets storage
- Security overview
Documents
-
Public Installation guides (Docker, Kubernetes, Ubuntu, cloud marketplaces)
-
Public Release policy
-
Public Release notes
-
Public License server and client information
-
Public ThingsBoard License Agreement (for on-premises deployed software)
-
Public Support services information
ThingsBoard Edge, IoT Gateway, TBMQ, Trendz and the mobile apps split responsibility differently. Ask our security team for a breakdown by product.
Read next
Can’t find what you need?
Our security team answers questions, shares documents under NDA and handles vulnerability reports.
-
Contact our security team
Questions, questionnaires and data requests.
-
Get documents
Certificates and policies; request the NDA ones from the library.
-
Report a vulnerability
Tell us privately. We reply within three business days.