- Four guarded ways in
- An answered call, a visitor key, the building PIN, or a resident's own slide in the app. There is no open-door link, and neither the cloud nor the management console can open a door.
- A short, capped pulse
- The door strike releases for three seconds at most. The server caps it, and the door controller is built to refuse anything longer on its own.
- No replays
- Old or repeated commands are rejected by both sides, so a recorded message cannot open a door later.
- Nothing goes unrecorded
- Every attempt is logged, granted or refused, with the reason. A door that did not answer is recorded as exactly that.
- Encrypted in transit
- Calls, sign-in and administration run over HTTPS and secure connections. Video and audio are encrypted between the door and the phone.
- Closed by default
- Administration endpoints are not reachable from the internet. Pages run under a strict content policy, and abusive traffic is cut off.
- Strong sign-in
- Passwords are hashed with Argon2id. Staff need two-step sign-in, residents can add it, and every session can be revoked.
- Access ends at once
- Remove a resident or disable a door and calls end and connections close right away, not at the next sync.
- Photos have an expiry
- Doorbell photos are deleted after 72 hours, opening photos after 30 days, from private storage that only the system reads.
- Hosted in the EU
- Our servers are in Amsterdam, and the log and photos are stored in EU data centres.