Governance built into the platform, not the questionnaire.
Utilities, regulators and IT directors look for this page specifically. Here is how smoc.cloud isolates tenants, scopes access, records every change and turns compliance into something you can show rather than claim.
Strict multi-tenant data isolation
Each tenant's devices, reads, alerts, KPIs and users are kept strictly separate on a shared platform. Per-tenant configuration — severity rules, KPI thresholds, roles — never leaks across boundaries.
Role-based access control
Custom roles scoped to exactly the capabilities an operator, analyst, field supervisor or regulator reviewer needs.
Full audit & change logging
Every configuration change, threshold edit, role update and case action is attributable to an actor and a time.
SLA & KPI governance
A configurable KPI catalogue covering connectivity, system performance, campaign execution, security & compliance and integration performance — with live dashboards, breach tracking and the history behind every number.
Security auditing
Security incidents on the estate — including tamper and unauthorised access events — are captured as alarms and reviewable in the audit trail.
Vulnerability remediation tracking
Firmware findings are tracked from identification through OTA campaign to closure, with evidence per device.
Every event, attributable.
Alarms, triage cases, KPI evaluations, threshold changes, role updates, campaign waves, field dispatches and logins land in one audit trail — attributable to an actor, a tenant and a millisecond.
This is the granularity a regulator's request or an internal incident review actually needs — and it is the same data that drives the live SLA dashboards, so the two can never disagree.
What a reviewer can verify
Each control area below is backed by evidence available in the platform itself rather than by assertion in a document.
Tenant data separation
Isolation enforced per record on read and write
Access control
Custom roles per tenant, enterprise identity federation
Change accountability
Immutable audit record: actor, target, before/after
Credential handling
Managed secret storage, scoped per tenant and integration
Operational transparency
Live SLA and KPI dashboards, exportable
Command traceability
Every remote action attributable end to end
Questions we expect from security and compliance teams.
How is one tenant's data kept from another's?
Every record is tenant-scoped, and per-tenant configuration (rules, thresholds, roles) is isolated with it. Cross-tenant access is not a permission that exists.
Can we restrict what a contractor or regulator reviewer sees?
Yes — custom roles can be scoped to read-only KPI and audit views, or to specific capability areas such as field jobs.
What gets logged?
Configuration and threshold changes, role and user changes, case actions, campaign progress, dispatches and authentication events — with actor and timestamp.
How do we evidence SLA compliance?
From the live SLA dashboards and their underlying audit history, exportable for a regulator or board pack. Certifications and formal attestations can be discussed with the CEHG team.
Questions procurement and security teams ask
Straight answers on isolation, access, secrets and audit evidence.
Need the implementation detail?
Tenant context binding, row-level authorisation, data partitioning, key and secret management, identity federation and boundary controls are documented on the security architecture page.
Bring your security questionnaire.
We would rather answer it in a demo than in a PDF. Request a session with the team.