Security at FYXO

🔐

Device credentials are encrypted at rest with AES-256-GCM and never stored in plaintext. All traffic is served over HTTPS/TLS.

🔑

API and AI-assistant (MCP) access uses OAuth 2.0 with PKCE and least-privilege scopes. Revoke any connected agent in one click, and every agent write triggers an email notification.

🧱

Data is isolated per account with Supabase Row Level Security, so an account can only ever reach its own sites and assets.

🛡️

Mutating endpoints are protected with CSRF validation, strict input validation and sanitisation, and sliding-window rate limiting.

🤖

AI can suggest, but FYXO validates every action before it runs: geofencing, power-drift detection, per-asset schedule limits, denial cooldowns and one-agent-per-asset conflict locks. AI cannot override safety.

📓

Every write is recorded in a full activity log (with CSV export) and emailed to you, so there is always an accountable trail.

🇪🇺

GDPR-compliant, with a published Privacy Policy, Cookie Policy and Data Processing Agreement. Built on Vercel and Supabase.