Roles and security

ODEvice is designed for a self-hosted runtime. Your backend remains responsible for the security posture of its deployment, network, secrets, and upstream integrations.

Runtime roles

The runtime distinguishes viewer and administrator capabilities. Commands and configuration changes must be authorized server-side; a hidden client control is not a security boundary.

Recommended practices

• Run the runtime behind your existing network and TLS controls.
• Store credentials and integration secrets outside application source code.
• Validate all values again in Python command handlers.
• Keep audit records for administrative commands where required.
• Apply least privilege to runtime users and upstream service credentials.
• Keep the SDK and runtime dependencies updated.

Product boundary

ODEvice does not provide a managed device cloud, MQTT broker, or automatic device provisioning. Bridge your existing systems through Python and apply the security controls appropriate to those systems.