Security & trust
We ask for as little as possible, and never write to your fleet.
A product security service that handles your build data has to meet the standard it asks of you. This is how we handle your data.
- Read-only connectors
- Fleet connectors (MQTT, AWS IoT Device Defender, Azure IoT Hub, Memfault) use read-only credentials that you create and can revoke at any time. We never send commands to your devices and never change your cloud configuration.
- Minimised data
- We take what a decision needs: component lists, versions and build configuration, plus aggregate fleet signals per firmware version. We don’t need your source code, device owners’ personal data or raw payloads.
- Hosted in the EU and UK
- Customer data is stored and processed in the EU and the UK. [Hosting provider and regions to be confirmed.]
- Data processing agreement
- A DPA is available for every paid plan, covering UK GDPR and EU GDPR. Email us to request it.
- Hash-chained audit log
- Every decision, edit, approval and submission is written to an audit log where each entry includes the hash of the one before it, so later tampering can be detected.
- You stay in control
- Nothing is filed with ENISA, a CSIRT or your customers without your approval. You can export your data, and we delete it when you leave. [Retention period to be confirmed.]
Sub-processors
[List of sub-processors, their purpose and location, to be published before launch.]
This website uses a form provider (Formspree) to receive design-partner applications. The two free tools run entirely in your browser and send nothing to us.
Report a vulnerability
We follow the advice we give. If you find a security issue in Warnbell or this website, email security@warnbell.com. We’ll acknowledge it within two working days, keep you updated, and credit you if you wish. Please give us reasonable time to fix it before you publish.
Machine-readable contact: /.well-known/security.txt