Security
How inbilit protects your buildings' data.
Where your data lives
- The application servers, the database, sign-in and file storage all run in the EU, in Frankfurt, Germany — for every customer, wherever they are.
- Some services process data outside the EU, such as e-mail delivery and the optional AI features. Each one is named in our Privacy Policy and Data Processing Agreement.
Encryption
- Everything travels over HTTPS, and browsers are told to use nothing else (HSTS).
- Data at rest is encrypted by our hosting providers.
- The credentials you give us for your meter and building systems are additionally encrypted by inbilit itself (AES-256-GCM) before they are stored.
Signing in
- The session cookie cannot be read by scripts in the page (HttpOnly), is sent only over HTTPS, and is not sent along with requests from other sites.
- Two-factor sign-in with an authenticator app. A full data export and changes to your subscription require it.
Who can see what
- Account owners and admins decide who in their organization has access.
- Tenants get their own portal and cannot open the management application.
- Every request is tied to your account from your signed-in session. Every database query in the application is filtered to your account, and an automated check stops any code change that is not.
Connected systems and uploads
- Data imports cannot be pointed at private or internal network addresses.
- Readings pushed to inbilit by webhook are accepted only with a valid signature for that data source.
- Our own services authenticate every request they send each other.
- Uploaded PDFs that contain JavaScript or launch actions are rejected.
AI features
- The in-app assistant works only after you enable it, and we record that choice. Contact details are removed from what is sent to the AI model.
- Invoice reading and Smart Setup say, before you upload, that the file is read by Anthropic (Claude).
In your browser
- A strict Content Security Policy with a fresh nonce on every page view, so only our own scripts run. Our pages cannot be framed by other sites.
Your data stays yours
- Owners and admins can export everything as a ZIP file (JSON, CSV or JSONL) at any time.
- If a personal-data breach affects you, we notify you within 72 hours of becoming aware of it, as set out in the Data Processing Agreement.
Legal documents
Data Processing Agreement · Privacy Policy · Legal FAQ
Report a security issue
Write to support@inbilit.com with what you found and how to reproduce it.