Onboard Security Brief

Edge Node

• Built on Linux Ubuntu: Clients benefit from a Linux distribution with enterprise-grade, industry leading security practices, and Ubuntu’s powerful file system permissions, user management, control groups, and firewall.
• Deploys on Virtual Machines: Onboard's Edge Node runs on a virtual machine, giving clients an isolated environment with easier scaling, stronger security, and consistent alignment with their organization's standards and processes.
• Read Only: The Edge Node performs read-only operations on a building's network, it does not write to or modify any building systems.
• Physical Security: The Edge Node, regardless of deployment machine, requires physical security as a baseline. Any device connected to a building's network is a potential access point and can be physically tampered with. We strongly recommend keeping all such devices in a secured, locked location

Communication: Network Edge and Cloud

• Network Traffic: The Edge Node pushes building data to Onboard’s cloud servers over HTTPS (TCP port 443), encrypted via TLS. For remote troubleshooting, Onboard uses UDP port 1501 via WireGuard®.
• VPN & Cryptography: Onboard uses WireGuard® as its secure VPN tunnel for edge software access during troubleshooting. WireGuard® uses state-of-the-art cryptography for end-to-end encryption. This includes the noise protocol framework, Curve25519, ChaCha20, Poly1305, BLAKE2, SipHash24, and HKDF. More performant than OpenVPN, WireGuard® is designed as a VPN for running on embedded interfaces as well as supercomputers, and has a minimal attack surface as compared to Swan/IPsec or OpenVPN/OpenSSL.
• SSH Access: When troubleshooting is required, Onboard accesses the deployed Edge Node remotely via SSH tunneled through the WireGuard® channel. Security settings are set as recommended by SSHAudit. The Edge Node is restricted to prevent tampering. Clients access a web interface hosted by Onboard’s cloud servers to monitor the status of their edge node connection.

Audit

• Onboard's Edge Node supports access for vulnerability scans and ongoing monitoring, if required by your IT. Access is provisioned by pre-configuring the Collector with the public SSH keys of your preferred auditing tool.
• Audit SSH access enforces the algorithm requirements below. Confirm your scanning tool supports these before initiating a scan.

‍

Data Storage

• Encryption at Rest: All data is encrypted at rest. Clients can retain data for up to 2 years, or request full data deletion at any time.
• Resilience during Outages: The Edge Node stores time-series data locally during any communication outage, preventing data loss. Depending on data volume, local storage can hold 2–3 weeks of data. Onboard provides hardware recommendations to ensure this capability is maintained.

Multi-Factor Authentication

• Onboard’s software and APIs are RESTful, JSON-based, and served over HTTPS. Authorization and authentication are handled via JWT tokens or account-linked, resource-scoped API keys. Multi-factor authentication is supported through TOTP and FIDO2 (e.g., hardware security keys). All APIs are documented using the OpenAPI v2 specification.

Activity Tracking

• Onboard maintains auditable logs of all significant system events, including software and deployment heartbeats, user logins, and data uploads. These logs are retained permanently and available for review upon request.