# Software that can move a megawatt has to be hard to misuse.

> How Myto secures energy control: shadow-mode dispatch, audited arming, role-based access, audit logs, self-hosted data and TLS. What we do and do not claim.

Source: https://myto.energy/security

This page lists the controls in the platform today, and says plainly what we have not yet certified.

Controls in the platform

## Control safety first, then access, then data.

AvailableBy design

ControlWhat it doesStatus

Shadow-mode dispatchBy default no command from the optimiser reaches a PCS. Live control must be armed explicitly per site.Available

Audited arming and controlArming, disarming and every control action recorded with the user or process that issued it.Available

Select-before-operateOptional two-step confirmation on manual control commands.Available

Local fallbackA stale or lost cloud link returns the site to a safe local mode; it does not keep executing an old schedule.Available

AuthenticationUser sessions and API keys for machine access.Available

Role-based accessOrganisation-level roles, with separate privileges for market and trading functions.Available

Market audit trailForecasts, schedules and bid drafts recorded with their inputs.Available

Rate limitingRequest limits on the API.Available

Encryption in transitTLS supported on the API, enabled per deployment.Available

Data residencySelf-hosted PostgreSQL system of record; keeping data in India is a deployment choice you control.Available

Edge software updatesManaged over-the-air updates for edge controllers.By design

Certifications

## What we do not claim.

Myto does not currently hold IEC 62443, ISO/IEC 27001 or SOC 2 certification, and the IEC 61850 interface is a lab mapping rather than a certified stack.

When a certification is awarded, the certificate will be linked from this page. Until then we will not describe the platform as compliant with any of them.

Reviews and disclosure

## Ask us the hard questions.

We complete security questionnaires as part of any evaluation, and walk your engineers through the control path and the dispatch gate.

If you believe you have found a vulnerability, write to [contact@myto.energy](mailto:contact@myto.energy?subject=Security%20report) with “Security report” in the subject. Please give us reasonable time to fix it before disclosing it publicly.

[Request a technical review →](https://myto.energy/contact?intent=ems)