Accountable access. Always running.
The right people see and do the right things, every action is on record, and monitoring carries on through outages, upgrades and even an expired licence.
Roles that fit how sites are run
- Four roles: operator, site viewer, commissioning engineer, admin. Several per person, each per site or every site, optionally until a date.
- Two-step sign-in for engineers and admins, with an authenticator app that works offline, and recovery codes.
- Break glass: an urgent action outside a role, with a stated reason, flagged for review.
- Sign-in throttling and PBKDF2-SHA256 password hashing; passwords are never stored in clear.
- An admin can end a user's sessions at once, for example after a password change.
Tamper-evident audit trail
Every change, sign-in and role switch. Each record is sealed to the one before, so tampering shows.
Site lifecycle
Commissioning → Live → Maintenance. A site goes Live only with an emergency contact; changes to Live sites are drafted, approved and published.
Signed licence
An Ed25519-signed licence, optionally bound to one machine. It never stops monitoring, even when it expires: only configuration changes are held.
BMS writes on record
Building systems connect only from allow-listed addresses, and every command write is recorded in the audit trail.
Nothing listens at the site
PanelTunnel and the site agent dial out over SSH or HTTPS / MQTT with TLS. No port is opened at the site.
Exposure flagged
A direct panel on a public address is flagged on the Panels page, so it is never left exposed by accident.
Resilience you can check every morning
- Nightly backup with an automatic restore test, so a bad backup is noticed the next morning.
- Upgrades back up first and roll back by themselves if the new version doesn't answer.
- Standby server (Enterprise): PostgreSQL streamed within about a second; one command promotes it, about 15 seconds in tests.
- Every server or link outage recorded, with the period nothing was heard.
- Map tiles kept on the server for 30 days, so maps work through an internet outage.
- Prometheus metrics and a service status page for your own monitoring.
Need our security brief?
The datasheet lists every control; ask us for the full review notes.