Security
Report a security problem
If you think you have found a security problem in Solar Split, email support@solar-split.com. Put "Security" in the subject. You do not need an account, and we will not ask you for personal information. Reporting is free of charge.
Please tell us:
- what you found and where (the website, the app, or the Home Kit)
- the steps to see it happen, and what you think the risk is
- your name or a handle, if you would like credit. This is optional.
What we promise
- We will acknowledge your report within 5 business days (Brisbane time, Monday to Friday, excluding Queensland public holidays).
- We will send you status updates until the problem is resolved, at least every 14 days, and tell you when it is fixed.
- We practise coordinated disclosure. We ask that you keep the details private until we have fixed the problem or 90 days have passed, whichever comes first. If we need longer, we will explain why and agree a date with you. We will credit you in our notes, if you want that.
- Safe harbour: if you act in good faith, we will not take legal action against you and will not ask anyone else to. Good faith means you stay within the limits below, report what you find to us promptly, and do not use it for gain.
Limits
- Only test your own account and your own Home Kit. Do not access, change or keep anyone else's data. If you come across someone else's data by accident, stop and tell us.
- Do not run anything that could take the service down, such as flooding it with requests, and do not send spam or phishing.
- Do not try to get into our staff accounts, or to trick our staff or customers.
This policy covers security research only. For a fault in a calculation, or any other help, see support. A machine-readable version of how to contact us is at /.well-known/security.txt.
What is in scope
- The Solar Split website and app at solar-split.com and its subdomains that we run.
- The Solar Split Home Kit: its software, its setup page on your home network, and how it talks to our service.
Out of scope: services run by other companies (for example our payment provider, the company that delivers your email, or your inverter and battery makers), attacks that need physical access to a hub you do not own, and social engineering. If a problem is in one of those, tell the company that runs it. You are welcome to copy us in.
Security updates and how long you get them
The Home Kit gets free security updates for 5 years after we last sell that model. There is no charge for security updates, and you do not need to do anything: the Home Kit checks for updates itself and installs them.
Security updates supported until 31 December 2031 (Solar Split Home Kit, first model).
| Model | Security updates until |
|---|---|
| Solar Split Home Kit (first model) | 31 December 2031 |
That date is the end date we have published for the model. We will never shorten it. If we are still selling the model later, or sell it again, the date moves out so it is always at least 5 years after our last sale, and we will publish the new date here as soon as we can.
When support ends
- We will tell account holders by email at least 6 months before the date, and show a notice in the app.
- Your Home Kit keeps working after that date, but we will no longer promise security updates for it. We recommend you replace it or stop using it on your network.
- If a serious problem is found in the last year of support, we will still fix it.
How we secure your hub
- No default passwords. There is no shared or universal password on any Home Kit, and no password login at all. Each one creates its own secret key and its own one-time setup code the first time it starts.
- No inbound ports. Your Home Kit only makes outgoing connections to our service. You never have to open a port on your router, and nothing on the internet can start a connection to it. The setup page is only available on the Home Kit's own Wi-Fi until you have claimed it.
- Signed updates. Every update and every instruction we send to a Home Kit is signed with a secret key that only we hold. The Home Kit checks the signature before it does anything, and refuses anything old, expired or altered. A new update that does not start properly is rolled back automatically.
- Support access only with your consent. Our staff cannot open a session on your Home Kit unless you approve it in the app. You choose how long it lasts and you can end it at any time. It is limited to a restricted support account, and you can see a history of every session afterwards.
- It only reads. The Home Kit reads your meters and cannot switch anything on or off.
- Your data is kept apart. Each customer's data is separate from everyone else's, and access tokens for your equipment are stored encrypted.
No system is perfect, which is why we want to hear from you. For how we handle your personal information, read our privacy policy.
The Home Kit and this website use open-source software. The notices are on the Open-source licences page.