Security and your data

A Multilarm device keeps its schedule, audio and configuration in your building and needs nothing from us to run. The optional Cloud Relay is the only part we host. It holds account e-mail addresses, hashed device tokens, command history and any configuration you choose to send through it — not your audio library. One rule outranks the rest: no security measure is allowed to silence a building’s alarm.

Where your data lives

On the device (your building): The configuration (plain XML), your audio files, the speech model, logs. Not sent to us. Not encrypted against you.
In the Cloud Relay (only if you use it): Account e-mail addresses and password hashes, device tokens stored as SHA-256 hashes, the commands sent through the relay and their results, and alert settings. Data is not sold or shared for marketing. Details: privacy policy.
Without the Cloud Relay: Nothing about your site reaches us at all, apart from an optional once-a-day update check if you turn updates on.

How cloud accounts and credentials are protected

Two-factor sign-in (TOTP) on the owner console, with single-use recovery codes.
Passwords stored with bcrypt; sign-in attempts are rate-limited and locked out per address.
Device tokens are stored only as hashes, so a copy of the database is not a set of working credentials. Tokens can be rotated from the dashboard.
Strict, HTTPS-only session cookies; CSRF protection on every change; prepared statements throughout; a fixed allow-list of commands a device will accept.
Security headers (HSTS, Content-Security-Policy, frame protection) on the cloud pages.
The device connects out to the relay. No inbound firewall port is opened in your building.
A daily digest to the operator of failed sign-in spikes, rejected tokens, new administrators and file-integrity changes; an alert on high-impact commands sent out of hours.

How the software you install is protected

Downloads come only from multilarm.com, winget and Chocolatey. Every file is listed in a signed SHA256SUMS — check yours with sha256sum -c SHA256SUMS or certutil -hashfile <file> SHA256.
Automatic updates are off by default. When on, the update manifest must carry a valid RSA-3072 signature made with a key kept offline; the device refuses anything older than what it has, keeps the previous version, and rolls back if the new one does not come up.
The consequence, stated plainly: someone who took over our web host could stop updates, but could not make your device run their code, because the signing key is not there.

If something goes wrong on our side

If we find or are told of a security incident affecting the Cloud Relay or the update channel, affected account holders will be told by e-mail, with what happened, what data was involved and what to do, as soon as the facts are established. Where the law requires a report to the Information Commissioner, it will be made within the legal time limit. Devices keep running throughout, because nothing in the building depends on the relay.

Reporting a vulnerability

E-mail hello@multilarm.com with “security” in the subject. Please report privately and allow time for a fix before publishing. Nothing will be pursued against anyone who reports in good faith. There is no bug-bounty programme.

What this page does not claim

No independent penetration test or certification (ISO 27001, Cyber Essentials) has been carried out yet. If your procurement requires one, ask.
Multilarm is not fire-alarm or life-safety equipment and is not certified to EN 54, UL 2572 or NFPA 72. It can sit alongside a certified system, never replace one.

Who runs this: About Multilarm. What keeps working if we stop: Longevity.