Security & Vulnerability Disclosure
How to report a vulnerability in Terrestream products or services. Public VDP referenced in Terms §16 and §22.5 (Appendix F).
How we protect your data
The measures below are the security controls we operate today.
- Customer data is stored on servers in the United States; our sub-processors are listed at /legal/sub-processors.
- Encryption in transit (TLS 1.2 or higher); disks are encrypted where our hosting provider supports it.
- Role-based access control and least privilege. Multi-factor authentication (an authenticator app, TOTP) is available for all accounts.
- Logging and monitoring of production systems.
- A secure software development lifecycle with code review, dependency scanning, and pre-release security testing.
- An incident response procedure aligned with the breach notification terms of our DPA.
If our cloud service is unreachable, the sensor keeps measuring and shows readings on its screen. App notifications and history resume when it reconnects.
Attestations and documentation
SOC 2 Type II is planned. Today we provide, on request and under NDA, a summary of our technical and organizational measures, a completed security questionnaire, and an executed Data Processing Agreement. Single sign-on and SCIM provisioning are on the roadmap. Organization accounts use role-based access, and multi-factor authentication is available.
Read the Data Processing Agreement, the sub-processor list, and our Privacy Policy. To start a vendor security review, contact our team.
Trust ledger
| FCC / ISED | Radio module documentation is published in Regulatory (FCC / ISED): FCC ID 2AC7Z-ESPS3WROOM1, IC 21098-ESPS3WROOM1. Final end-product SDoC and labeling are completed before shipment. |
|---|---|
| SOC 2 | Type II is planned; a security evidence package is available under NDA for commercial evaluations. |
| Warranty | 1-year limited hardware warranty. |
| Power | USB-C PD with UL-listed power supply in the box. |
| VDP | Public vulnerability disclosure policy and security.txt are available. |
| Data portability | MQTT and Home Assistant for local automations. To request a copy or a portable export of your personal data, use the privacy self-service portal. |
| IP | TerrestreamSM is a service mark of Aerodyne Inc.; the leaf logo and “Breathe Better. Live Smarter.®” are registered trademarks of Aerodyne Inc. Patents pending. |
Data portability and local operation
Terrestream publishes local readings for local automations. To request a copy or a portable export of your personal data, or to have it corrected or deleted, use the privacy self-service portal. Formal tier terms live at /legal/tier-features.
Reporting channel
Open a security disclosure with reproduction steps. Our security contact details are also published at /.well-known/security.txt per RFC 9116.
Safe harbor
Good-faith research that follows this policy will not result in legal action by Aerodyne. Avoid privacy violations, data destruction, and service disruption. Do not interact with accounts other than your own.
Acknowledgment timing
We acknowledge reports "within a reasonable period" per Terms §16.5. We will keep you updated on triage status and a mutually-agreed coordinated disclosure timeline.