Security
Security boundary enforced in hardware.
Connected devices usually rely on software to keep device code away from the network, that is, if they segregate at all. WattStack's security isolation is a physical property of the module itself and is inherently harder to bypass.
Book a security reviewWhy hardware, not software.
Software isolation is a promise made by code, and code can be misconfigured, compromised, or patched around. A processor with no wire to the radio cannot reach the network on its own, irrespective of what code runs. On the WattStack Edge, everything sent passes through a coordinator that inspects it first. Verifiable by reading the schematic, not by trusting code.
The tri-processor architecture
Three processors, enforcing the perimeter.
Patent pending
The Edge's patent pending hardware architecture is based on 3 physically distinct processors.
- The radio processor handles communications, with Wi-Fi 6, BLE 5.4, and Thread built in but no device logic.
- The coordinator, a hardware firewall, is self-contained and inspects and arbitrates every message.
- The OEM sandbox is a dedicated processor for the manufacturer's (OEM) code, with no network interface of its own.
Device logic can only reach the network through the coordinator chip. A compromised driver cannot reach the network directly with blast radius confined to the sandbox's scope. Isolation is enforced by the hardware layout, not by software you have to trust.
The boundary
What the boundary actually stops.
No wire to the radio
The sandbox, where OEM code runs, shares no bus with any radio or network interface. Its only route off the chip is a dedicated, encrypted link to the coordinator.
Nothing crosses raw
The coordinator inspects and translates every message between the two internal buses. Raw packets are never forwarded between them, and every command from the sandbox is checked against its allowed range before the coordinator acts on it.
The device's own limits win
Physics-based limits (fuse protection, boil prevention, anti-freeze, overcurrent etc) are enforced on the device itself. They sit outside the network domain and cannot be reached by any external command.
Only standardised protocols leave
The firewalled and mediated nature of the architecture means that proprietary communications never reach the network raw; the network sees only the standardised protocols and data structure that the Edge speaks on its behalf.
Device identity
Every device must prove identity.
Each WattStack Edge mints its own key pair when the unit is manufactured and stores the private half securely. Only the public half ever leaves the module, inside a certificate request. The certificate that names your device is issued against a public key whose private half WattStack has never held. Every connection after that is authenticated in both directions.
The private key never leaves the device
Created in-situ on the unit and never exported, transmitted, or held in escrow. Moving a device between environments re-signs the same public key rather than rekeying the unit.
The radio cannot sign
The processor that owns the network has no access to the identity key, so a compromised radio cannot pass itself off as the device.
Both ends are checked
The device checks the broker against the WattStack root, and the broker checks the device against its certificate. A connection that fails either way is refused, and there is no unauthenticated fallback.
The name is the device's own
The certificate carries an identifier the Edge generated for itself based on information only it knows, not something transmitted from a network source.
The other direction
What WattStack cannot do.
The same boundary that contains device code also limits us, by hardware construction rather than by software policy.
Hold your device's key
The private half of each device's identity key is generated on the unit when it is manufactured. WattStack has never held it.
See your protocol in the field
A driver may be written with sight of your protocol, but the running platform has no view of it. Your driver translates the protocol inside the sandbox, so what reaches the coordinator is already the standardised points, never the raw comms.
Read your driver off a module
Each unit encrypts its flash with a key its own chip generated. There is no fleet-wide break. What is recovered from one module tells an attacker nothing about any other.
Sign code as you
Your signing key is generated by you and held by you. WattStack never holds it, and code you write carries your signature, not ours.
The chain of trust
Nothing runs unless it is signed.
OEM code reaches the sandbox as a single signed blob. It carries its own authentication, so no part of the delivery path is trusted with the contents. Every check completes before a byte of it executes.
The device itself
Signed firmware only
Every image is verified at boot, so unsigned code, WattStack's and the manufacturer's alike, does not run.
Roots can be rotated
A compromised root key does not mean recalling hardware. The fleet moves to another root instead.
Flash encrypted per module
Each unit encrypts its flash with a key its own chip generates and holds in one-time-programmable fuses. Reading the flash off one module reveals nothing about any other module.
Rollback is one version deep
A failed update falls back only to the image WattStack last committed on that unit, so a bad release cannot take a device further back than one version. Every fallback is reported to you and to WattStack, so a pattern across a fleet is visible rather than quiet.
Every driver it runs
Chain and revocation
The certificate chain is verified before anything runs, and a key on the revocation list is refused outright.
The exact bytes execute
The signature covers the exact bytes that will run, so what was checked is provably what executes.
Never an older version
An older driver cannot be reinstalled, and a revocation is permanent.
Hardware by grant only
A driver reaches only the hardware it has been granted. What the platform reserves stays reserved.
Torn down on breach
A driver that misbehaves is stopped and reported to you and to WattStack. The device's own physics-based protections sit below the sandbox and are unaffected by a teardown.
Compliance
What this means for compliance with incoming regulations.
Global policies are moving towards energy devices that are secure by design, and the hardware boundary decides where that load lands. Your safety-critical protections and your device logic stay on the device and stay yours. Identity, key handling, signed delivery and the connected surface sit on the Edge, so WattStack-enabled devices are positioned to keep the bulk of the cyber-certification load away from manufacturers' firmware teams.
Dedicated cyber consideration
In the UK, PAS 1878:2026 signals direction by adding a dedicated cyber security clause for energy smart appliances.
More stringency incoming
Regulators globally (including DESNZ / Elexon Smart Secure Electricity Systems programme in the UK) are expected to introduce more stringent tests for device compliance in order to protect grids. WattStack is regularly consulted and has a voting member in the SSES Security Governance Group.
Put the boundary to work.
Talk to us about security architecture. We will take your firmware and security team through the schematic and the trust boundaries it enforces, under NDA.