Connections between the SUPLA app and the SUPLA server, as well as connections from all official SUPLA devices to the server, are encrypted. However, the security of the complete system also depends on the device, its software, the Wi-Fi network, the account password, the phone, and the way access and integrations are configured.
Administrative access to the official SUPLA infrastructure is restricted to authorized personnel. The infrastructure is maintained, updated, and monitored, and the data is covered by backup mechanisms. Backups are primarily intended to restore the service after a serious failure. They should not be treated as a replacement for user data exports or as a guarantee that an individual deleted account item can be restored.
For a private SUPLA instance, its administrator is responsible for server security, administrative access control, updates, certificates, backups, and data recovery.
Unofficial DIY devices and modifications may work differently from official devices. Typical SUPLA devices based on Arduino Mega and other 8-bit AVR microcontrollers do not support an encrypted connection to the server. In older ESP8266-based DIY projects, encryption was also sometimes disabled by default because of limited RAM.
Users should:
- use a unique and strong password;
- secure the email account used for access recovery;
- keep the app and device software up to date;
- regularly review access identifiers and registered client applications;
- remove unused API tokens and integrations;
- properly secure any private server;
- not share access credentials with people who should not manage the installation.
A direct link should be treated as an access key to the assigned function. We do not recommend sending direct links that execute an action, such as opening a gate, by email. Email security systems may automatically open links while scanning messages and unintentionally trigger the assigned action. Share direct links only with trusted people and remove them when they are no longer needed.