Architecture and segmentation
We treat the lighting system as its own zone, in the sense used by IEC 62443: a group of devices with a shared security requirement, connected to other zones only through defined, documented conduits.
- The lighting network is segmented. It runs on its own VLAN or a physically separate network, agreed with your IT team during design. It doesn’t share a broadcast domain with corporate workstations or guest Wi-Fi.
- Ledger connects outbound only. The Lytbit gateway sits on the lighting segment and opens an encrypted, outbound-only connection to Ledger. There are no inbound firewall rules, no port forwarding, and no remote desktop tools in your building.
- The BMS link is a defined conduit. Where both sides support it, we use BACnet/SC, defined in ASHRAE 135 Annex AB. It carries BACnet over TLS-secured WebSocket connections with mutual certificate authentication and needs no broadcast management devices. Where BACnet/IP is the only option, it stays inside the segment, with firewall rules that allow only the BMS to reach it, and it is never exposed to the internet.
- Lighting doesn’t depend on the cloud. If the internet connection or Ledger is unavailable, every sequence keeps running on the local controls. The gateway buffers data and backfills Ledger when the connection returns, within the limits of its storage.
- Default credentials don’t survive commissioning. We change every default password, disable unused services where the platform allows it, and record the result in the configuration report.
Before a new device joins a design, we run it on the Lytbit Lab bench with packet capture and give your IT team a summary of everything it sends: destinations, protocols, and frequency.
Standards we design to
IEC 62443 is the series of standards for industrial automation and control system security, and the best fit we know for building systems. We use its zones-and-conduits approach (IEC 62443-3-2) when designing networks, its system requirements (IEC 62443-3-3) when deciding what a design needs, and its component requirements (IEC 62443-4-2) when evaluating devices. We use the series as a design framework. We don’t claim certification against it.
The DLC NLC cybersecurity requirement has applied since NLC5. Systems listed on the DLC Qualified Products List under NLC5 and later must meet it, and we check the listing for every system we design around. We treat a listing as a starting point, not a substitute for reviewing how the system is installed on your network.
NIST guidance on operational technology security informs how we handle remote access, logging, and incident response.
For a buyer’s view of these issues, read questions to ask before your lighting network touches IT. For a full assessment of an existing building network, see building network and IoT/OT cybersecurity.
Data ownership
You own the data your building produces. We process it to provide the service you’ve asked for, and for nothing else. Ledger is hosted in the US. You can export everything at any time as CSV, through the API, or as an MQTT stream, without asking us and without paying an export fee. We never sell your data, share it for advertising, or use it to compare you with other customers without your written permission.
Retention
- Ledger data (telemetry, reports, and change logs) is kept for the term of your subscription, so that baselines and M&V history stay intact. You can ask us to apply a shorter retention period to any site.
- At the end of a subscription, we deliver a full export, delete your data from production systems within 30 days of your confirming receipt, and let encrypted backups age out within 90 days.
- Website form submissions are kept for 24 months and then deleted. They’re processed by a Cloudflare Worker, checked with Cloudflare Turnstile, and stored in Cloudflare KV. The website uses cookieless analytics and sets no advertising or tracking cookies. See the privacy policy.
Data is encrypted in transit with TLS and encrypted at rest. Each gateway has its own credentials, so one compromised device can’t speak for another.
Firmware policy
- No automatic updates on production lighting. Auto-update stays off on every system we commission, unless you choose otherwise in writing.
- Bench first. Every update is tested in the Lab against the device combination in your building before it’s scheduled.
- Scheduled with you. Updates are applied in an agreed window, usually after hours, with a configuration backup taken first and a rollback plan in hand.
- Advisories tracked. We follow manufacturer security advisories for the platforms we support. On Steward plans, firmware management is included and we tell you about relevant advisories with a recommended timeline. On Watch and Tune plans, we advise and schedule the work with you.
Reporting a security issue
If you believe you’ve found a vulnerability in Lytbit Ledger, a Lytbit gateway, or a system we commissioned, email lab@lytbit.com with “Security” in the subject line. A person will acknowledge it within one business day. Please give us a reasonable chance to fix the issue before disclosing it publicly.
