Security

Have you found a vulnerability?

Write to kontakt@gridzeno.dk. Tell us what the problem is and where, how we can reproduce it, and what it can be used for. Feel free to write in Danish or English.

We confirm that we have received your message and keep you informed until the problem is resolved. If you would like to be credited when it is fixed, just say so.

Rules for investigating GridZeno

• Only use your own account and your own system. Do not touch other people's accounts, data or dongles.
• Never try to control someone else's inverter.
• No denial-of-service attacks, spam or attempts to deceive us or our suppliers.
• Stop as soon as you have demonstrated the problem, and do not keep other people's information that you happen to see.
• Give us time to fix the error before you tell others about it. We agree a date with you, normally within 90 days.

If you follow the rules and act in good faith, we will not take legal action against you because of your investigation.

The rules apply to the website, the web app, the app, GridZeno's servers and GridZeno Dongle with its firmware. Errors in our suppliers' own services, for example Stripe, Cloudflare or Google, should be reported to them.

How we protect your system

• GridZeno never sends commands to your inverter. The dongle fetches a plan and carries it out itself, and only when you have chosen Automatic.
• Plans and firmware updates are cryptographically signed. The dongle rejects anything not signed by us before it reaches the inverter.
• The limits for the battery's state of charge are in the inverter's own settings, so they hold even if the dongle or the internet fails.
• The dongle creates its own secret key, and we only store a hash of it. Your password never enters the dongle.
• Passwords are stored as hashes, and keys to our suppliers are stored encrypted. Login and other sensitive actions are limited against guessing.
• You can turn on two-step login under Profile in the web app. You then also have to enter a code from an app on your phone when you log in.
• We never see your card details. Payment takes place at Stripe.
• All traffic is encrypted, and your data is stored on our own servers in Denmark.