Security
ZiggyMeter is designed to be safe on a home network without depending on a cloud service. This page explains what is protected, and how.
Firmware
The device firmware is protected using strong encryption keys, safeguarding sensitive information such as Wi-Fi credentials from unauthorised access. Firmware updates are delivered regularly to address potential security vulnerabilities.
All update files are encrypted and digitally signed. If a file is modified — even by a single byte — signature validation fails and the device rejects the upgrade. This prevents the installation of malicious code and guarantees the integrity of every update.
No downgrades
The device only accepts firmware newer than what it is running. Allowing downgrades would make it possible to reinstall a version with known vulnerabilities and so bypass security fixes — a rollback attack. See Firmware upgrade.
Encrypted data transmission
| Wi-Fi mode | Transport | Why |
|---|---|---|
| Client (joined to your network) | HTTPS on port 443 | Normal operation; all traffic is encrypted with TLS. |
| Access Point (device's own hotspot) | HTTP on port 80 | Used only for initial setup. Port 443 is closed. |
INFO
Why plain HTTP in Access Point mode? A self-signed certificate on a hotspot produces a browser warning that users are trained to click through, which teaches exactly the wrong habit — and some phones refuse the setup page entirely. Because the login is challenge-response, no password crosses the wire either way, and the hotspot is a private link between your phone and the device with no route to the internet.
Once the device joins your own Wi-Fi it switches to HTTPS automatically.
The certificate warning
On your own network the device serves HTTPS using a certificate it generated itself. Your browser will warn that the connection is not private the first time you connect. This is expected: there is no public certificate authority that can vouch for a device on your LAN. The connection is still encrypted.
If you run your own certificate authority, you can install a certificate it issued, and the warning goes away on every device that trusts that CA. See HTTPS certificate.
API access
Every API request carries a bearer token. A login token expires after 30 minutes. For programs, you can create up to three long-lived tokens that never expire. The device keeps only a hash of each, so a token cannot be read back from the device, and each can be revoked on its own. See Long-lived access tokens.
Zigbee protocol security
For local wireless communication the device uses Zigbee, which provides a lightweight, low-power and secure framework for IoT networks. Zigbee implements AES-128 encryption for all data packets, so information exchanged between the device and other network nodes is encrypted and authenticated. This prevents eavesdropping and unauthorised command injection within local networks. Zigbee's built-in mechanisms also include device authentication, key management and secure network formation.
Meter-side security
When the meter uses DLMS/COSEM, ZiggyMeter supports the meter's own security levels:
| Level | Meaning |
|---|---|
| None | No authentication. |
| Low (LLS) | Password authentication. |
| High (HLS, GMAC) | Challenge-response authentication using an authentication key. |
Payload encryption is supported using the block cipher key (GUEK) and authentication key (AK) supplied by your utility. Keys and passwords are stored in the device's encrypted configuration and are never returned by the API — the device only reports whether a password is set. See Meter protocols.
Do not expose the device to the internet
ZiggyMeter is built for a local network. Do not forward a port to it from the public internet. If you need remote access, use a VPN back into your own network, or put a hardened reverse proxy in front of it. See Custom and cloud.
Continuous security assurance
Secure firmware development, encrypted and signed updates, challenge-response login, TLS in client mode and Zigbee encryption combine into a layered posture. The firmware is developed in the European Union and initial production programming is carried out there too.
Found something? Report it to support.