Security, compliance and data protection

Pointnode holds the operating record for industrial assets: live condition data from equipment, inspection and statutory records, pre-use checks, lock-outs, and the audit history around them. What we protect is that data, the accounts that reach it, and the controls that act on equipment.

Your data is stored in a database hosted in London, United Kingdom. The main hosting providers are below; the full list, with what each processes and the transfer safeguards, is the sub-processor list.

The web application’s server functions are configured to run in London. Optional features use further providers: email delivery, billing, error monitoring and, where enabled, AI analysis — see Data protection.

The detail is on our platform security page. In summary:

• Per-asset identity. Per-asset device identities use mutual TLS on the MQTT telemetry path: an asset presents its own certificate, not a shared key.
• Tenant isolation. Requests made on your behalf run through row-level security in the database. Privileged server-side paths that bypass it are inventoried and reviewed.
• Audit log. Security-relevant actions are written to an append-only audit log that the database refuses to edit or delete.
• Encryption. TLS 1.2 or later in transit to Pointnode Cloud. Data in Pointnode Cloud is encrypted at rest by our database and hosting providers. Data buffered on an on-site Edge gateway is not yet encrypted at rest.
• Sign-in. Authenticator-app two-factor authentication is available to every user. Enforcing it for privileged roles is built but not yet switched on.

Pointnode is not yet certified against any information-security standard. The table states where each one stands.

The Cyber Resilience Act (Regulation (EU) 2024/2847) sets security requirements for products with digital elements placed on the EU market. As we read it: obligations to report actively exploited vulnerabilities and severe incidents apply from 11 September 2026, and the remaining obligations, including the essential security requirements and conformity assessment, apply from 11 December 2027. Our reading is pending specialist legal review.

This is a statement of where we are, not a claim of conformity. No Pointnode product has been assessed for conformity and no EU declaration of conformity has been issued.

Report a vulnerability to security@pointnode.io. The policy is published at /.well-known/security.txt and on the security page, including response times and safe harbour for good-faith research.

We rate severity with CVSS v4.0. Published security advisories are listed in the advisories section of the security page. No advisories have been published to date.

• Agreement and policy. Our data processing agreement and privacy policy are published.
• Sub-processors. Every provider that processes customer data is on the sub-processor list, with region and transfer safeguard. Organisation admins are notified at least 30 days before a sub-processor is added or replaced.
• Data residency. Customer data is stored in London, United Kingdom (eu-west-2). Some providers process data elsewhere for their function — for example email delivery and the optional AI features in the United States — under the safeguards stated on the sub-processor list.
• AI features. Asset Intelligence is optional. Where it is enabled, a bounded asset context is sent to Anthropic PBC and Voyage AI (MongoDB, Inc.), both in the United States, under EU Standard Contractual Clauses or the UK International Data Transfer Agreement. As our DPA states, Anthropic does not train models on commercial API Customer Content by default.

Security

security@pointnode.io

Privacy and data protection

privacy@pointnode.io

Sales and demonstrations

Book a demonstration

Pointnode Limited, registered in England and Wales, company number 13338758. Registered office: Kingsland House, 39 Abbey Foregate, Shrewsbury, Shropshire, SY2 6BL. ICO registration ZC156059.