Security and trust
Security is the operating model.
The door decides locally. The factory issues device identity. Credential secrets stay sealed. The ledger keeps the trail. The copilot stays in Europe and does not open a door.
Protection you can inspect.
The door, the chip, the factory identity, and the evidence trail are the same operating model.
-
Local enforcement
Cards, Wallet QR, and FIDO2 NFC are decided on the Accena reader or on Edge. The cloud publishes the allow list and records the local decision. It does not re-open the door. Product passkeys and Access QR stay cloud-verified.
-
Cryptographic protection
Card keys, writer envelopes, and provisioning secrets are encrypted at rest and delivered in AES-256-GCM envelopes. Ausweis-Studio never shows key bytes. LEGIC advant binds physical master tokens; neon keys stay in LEGIC Trusted Service. Operational keys are not stored as plaintext in the running system.
-
FIDO2 NFC, local-first
A FIDO2 NFC key taps at the Accena reader, or the same NFC session runs transparently over Edge. The signature is checked against NG-Key door keys on the device. The cloud does not re-evaluate the tap. Product passkeys and Access QR stay cloud-verified.
-
Tamper-evident ledger
Security-relevant events are written to a hash-chained ledger. Later records depend on earlier ones, so the trail cannot be quietly rewritten. Secrets, claim tokens, and key material never enter the chain.
What the ledger is for.
Not a second product. An independent evidence record of access, credentials, and administration.
- What it records
- Local access decisions, credential issue, wallet-pass lifecycle, encoding outcomes, and device assignment or activation are recorded as bounded events — without putting secrets, claim tokens, or key material in the chain.
- Why it matters
- Operators can inspect history. Auditors get a chain they can defend. Nobody can edit yesterday without breaking the evidence.
- Not a door AI
- The copilot does not grant access at evaluate time. Policy and local reader decisions remain deterministic. Inference does not leave our European private network.
Copilot, hosted in Europe.
Our own model, on our European infrastructure. Assistance on the control plane. Never a decision on the door path.
Operators ask in natural language: who may pass, why a door denied, which readers drifted. The copilot runs on a model we host in Europe. Prompts stay on our private infrastructure — not a public LLM service. Proposals follow existing permissions. Confirm before anything is written.
Route of trust
Factory certificates, signed firmware, and live hardware-trust checks on Edge, IO, and readers. Claim tokens and leftover MQTT passwords do not authorize a production device. A mismatch is visible. The device does not silently join the fleet.
Signed OTA throughout
Accena readers, Edge gateways, and NG-IO take signed firmware from one catalog. A device that does not match stays visible. The Trust Center shows what is running.
A defined security path
Product security reports follow a published disclosure path. The operator still notifies the competent authority under the operator’s own duty. Buying the platform does not make the operator NIS2-conformant.
Security whitepaper
Use the whitepaper when a procurement review needs a longer security narrative. CRA and NIS2 sit on the next page: product law for the device, operator duty for the service, no stamp on purchase.