How Hydrum handles access and credentials

Encrypted connections and controller identity

Website access uses HTTPS/TLS. The Harreither relay connection also uses TLS, with the relay certificate checked against a pinned fingerprint. Hydrum verifies the controller's identity against Harreither's root key before sending a login.

The controller protocol is encrypted inside the relay connection. The relay carries ciphertext but still handles connection metadata. Hydrum processes the controller readings to provide the service.

Passwords and stored controller credentials

Hydrum account passwords are salted and hashed with scrypt. They are not stored as readable passwords. Login and recovery requests are rate-limited.

The controller password and auth code are stored encrypted with AES-256-GCM under a server-managed key. Hydrum decrypts them when opening a controller session. This is not zero-knowledge storage, and it does not mean every field in the database is encrypted.

Sessions and secret links

Session tokens and account recovery, verification, invitation and display tokens are stored as hashes. Account recovery and verification links expire and are single-use; opening a page alone does not consume them. A password change or reset revokes earlier sessions.

Display links contain random 256-bit tokens and are shown once when created. Anyone with a link has its current permission. Keep its URL and QR code private, and pause or replace the link if it is exposed.

Access is checked again before a write

Household roles separate viewing, control and management. Only the system owner can replace controller credentials, remove the system or grant management access. Display links have a narrower wall-only scope.

The server rechecks current account or display permission for actions, including immediately before a queued controller write. A page left open does not preserve an old permission after access is removed.

A requested change is not always a confirmed change

Hydrum waits for controller acknowledgement and records rejected or uncertain outcomes. A timeout after sending may leave the result unknown. Check the actual setting before retrying; multiple room changes are not a transaction that can be rolled back together.

Hydrum does not update firmware, synchronise controller time or write controller PINs, passwords or auth codes. Timed-away returns have permission and mode checks, but availability and timing are not safety guarantees.

Protect the access you share

This description is not a security certification or a claim of an independent audit. Retain access to the controller or its usual controls if the website, relay or internet is unavailable.

• Use a unique Hydrum password and keep your browser and tablet software updated.
• Give household members individual accounts and communal tablets limited display links.
• Do not publish credentials, recovery links, invitation links or display QR codes. Report a problem through the service administrator's existing contact method without including secrets.