Security Fundamentals

Novant is designed to integrate with building networks without introducing security risk. This document covers the security model for edge nodes and how data moves between your site and Novant — the information IT teams typically need before approving a deployment.

Outbound-Only Communication

Edge nodes use an outbound-only communication model. All connections are initiated from inside your network — the edge node reaches out to Novant, never the other way around.

• External systems cannot initiate connections into your network.
• No inbound ports need to be opened.
• Each edge node connects to a single endpoint: node.novant.io over HTTPS (port 443).

This keeps the building network invisible to the outside world while still enabling cloud-based management, monitoring, and data access.

Data in Transit

All communication between the edge node and Novant is encrypted using TLS. Data is transmitted over HTTPS, ensuring it cannot be intercepted or tampered with in transit.

What Data Leaves the Building

The edge node sends operational data — point values, timestamps, and device metadata — to Novant. It does not transmit personally identifiable information, credentials, or network configuration details.

Building automation protocols (BACnet, Modbus, etc.) remain local to the building network. The edge node collects data from these protocols on-site and only the resulting point data is sent to Novant.

Edge Node Authentication

Each edge node is issued a unique license file that authenticates it with Novant. The license is tied to a specific project and must be installed on the node before it can connect. Without a valid license, the node cannot communicate with Novant.

Firmware Updates

Edge nodes receive firmware updates over the same secure outbound connection used for data. Updates are downloaded from Novant and verified with digital signatures before installation — if the signature is invalid or missing, the update is rejected.

Updates are included as part of your Novant plan and provide security patches, bug fixes, and feature improvements. Virtual nodes restart automatically after an update when configured with restart: always in Docker Compose.

Hardware Node Security

Hardware nodes include additional physical security measures beyond what virtual nodes provide.

• Digitally Signed Firmware — every firmware release is sealed with a unique digital signature by Novant. The hardware node verifies this signature before installing any update. If the signature is invalid, broken, or missing, the device refuses to install it.

• Secure Boot — each time the hardware node powers on, it verifies the integrity and authenticity of its software before running it. If the software has been tampered with or lacks a valid signature, the device blocks it from executing. This protects against both remote attacks and physical tampering.