Smart device app and cloud security evidence
Request a data-flow map, authentication demonstrations, encryption details, an access permissions matrix and security test reports with evidence of fixes. Match everything to the app, firmware and cloud service you will actually supply. Put unresolved gaps into the purchase decision with Cambridge China Bridge.
Define the service you are assessing
ICO guidance says personal information must be processed with appropriate security and protection against unauthorised or unlawful processing. The checklist below turns that principle into practical supplier requests. Keep the product paperwork covered by our connectable product security guide alongside this assessment.
Ask for a diagram showing what personal information moves between the device, companion app, cloud, support team and outside providers. Identify who operates each component, where information is stored and who can retrieve it. Record the proposed app release, firmware version and cloud configuration, following our software approval guide.
Demonstrate authentication and account recovery
Ask the app provider to demonstrate registration, login, device pairing, password reset and account recovery using test accounts. Request the password policy and evidence of controls against repeated guessing. Ask which user and administrator accounts support multifactor authentication, how it is enforced and how recovery works when a user loses their authentication method.
Check that recovery cannot bypass the normal protections. Demonstrate what happens after logout, a password change, device removal and a change of owner. Ask how existing sessions and access credentials are invalidated. Request redacted results rather than real customer passwords, keys or account records.
Locate encryption and responsibility for keys
Request an encryption map covering device-to-app, app-to-cloud and cloud-to-provider connections, plus storage on phones, servers and backups. Ask for the protocols and algorithms used, configuration evidence and test results. Have a security specialist assess suitability for the information involved; a supplier's statement that the service is encrypted is insufficient purchasing evidence.
Ask who holds encryption keys, how access is restricted and how keys are replaced or withdrawn after compromise. Check whether support staff can view decrypted recordings or other personal information. If the supplier claims end-to-end encryption, ask them to demonstrate where decryption occurs and explain any exceptions for sharing, recovery or support.
Prove access boundaries work
Request a permissions matrix for device owners, invited users, factory staff, app developers, cloud administrators and support agents. For each role, record which information it can read, change, export or delete. Ask for evidence of individual staff accounts, approval for privileged access, access reviews and removal when staff leave.
Arrange authorised tests using separate customer accounts. Check whether changing a device or account identifier exposes another customer's information, whether withdrawn sharing still works and whether support access expires as agreed. Ask for redacted audit logs showing who accessed information and what they did. A hidden app button alone does not demonstrate a working access boundary.
Working out your own order? Send us the product on WhatsApp and we reply the same working day: WhatsApp us
Require test scope, fixes and release evidence
Request a dated security assessment naming the tester, methods, app and firmware versions, cloud environment and exclusions. Ask whether testing covered account recovery, service interfaces, customer separation, encryption configuration and administrator access. Distinguish automated scanning from penetration testing. Use our test report verification guide to check the report's identity and scope.
Ask for a findings register linking each issue to its impact, responsible owner, correction and retest result. Agree which unresolved findings block your order or launch. If confidentiality limits disclosure, arrange controlled reviewer access or a redacted report that retains scope and findings. Record who monitors the service, handles incidents and triggers further assessment after material changes.
Frequently asked questions
Is a product security statement enough for the app?
Request separate evidence for the app and cloud. A product statement does not show how account recovery, customer separation, encryption or support access behaves in the service you will supply.
What if the factory does not run the cloud?
Ask it to identify the operator and arrange access to that operator's evidence and technical contact. Record who will fix service issues before choosing the supplier.
Can I accept a security report for another app?
Ask the tester to explain its relevance to your release and configuration. Obtain further assessment where the report excludes your service or material changes.
Should I ask for customer data to check security?
Use test accounts, synthetic information and redacted logs. Agree authorised testing with the service operator rather than attempting access to real customer accounts.