Security
The model runs on the machine, not in the cloud.
The AReCoS controller carries a Digital Twin that runs on the controller, at the machine’s own control rate. Nothing has to leave the site for it to optimize, find faults or act, and it keeps running with the internet down. To report a security flaw, email info@arecos.net.
Cloud twin or on-machine twin
Where the model runs decides what leaves the site.
Cloud-based optimization
Some cloud-based optimization architectures transmit operating data to remote servers and send updated setpoints back to site equipment. A chat assistant or phone app that can change a setpoint from outside the building is the same kind of path. AReCoS is designed to execute its physics model and optimization locally, without requiring a remote command path.
A Digital Twin on the controller
Sensors read pressure, temperature and humidity of the refrigerant, air and liquid. The software runs on the controller’s own processor, sized to its memory and CPU. Setpoints still come from your thermostat or building system. Commands go straight to the compressor, expansion valve, fans, pump and dampers.
What it does each control step
Before installation, the machine’s physics model is run across uncertainty and failure cases to train a failure model. On the machine, the model predicts what the sensors read and what no sensor reads, such as refrigerant mass flow. The optimizer sets every actuator together for the lowest energy over the horizon while holding the setpoints. Each command is screened against the failure model, the operating constraints and the configured safety limits before it goes out.
From FIG. 1 and FIG. 2 of US 2024/0295337 A1, issued as U.S. Patent 12,768,557. How the controller runs the model on the machine.
- Data leaves only if you chooseReports are your choice: readings over BACnet to your own systems, or optional AReCoS cloud monitoring, which reads and has no path to command your equipment.
- Running with the internet downOptimizing, fault detection and command screening all run on the controller, so they carry on when the connection is gone.
- Grid requests stay requestsA utility signal reaches the controller through your building system or a gateway on your own wired network, never by radio or through an AReCoS service. The limits set at the machine stay in force.
Running locally removes one attack route, not every risk. The local network, service access, sensors and the people with access remain, so we agree the checklist below with your teams.
Show what the October 2026 supermarket attack teaches
In October 2026, attackers remotely switched on defrost cycles in refrigeration controllers in about 700 French supermarkets, the French government said, and fresh and frozen goods were lost (Associated Press report). As of early November 2026, how the attackers got in had not been made public, and no cloud service had been reported in it.
The lesson is about the path, not one brand of equipment. France’s cybersecurity agency told operators to take these controllers off the internet and put remote maintenance behind a protected network (CERT-FR alert, in French), the first of five steps CISA and its partners set out.
EU Cyber Resilience Act
Designed to the Act’s essential requirements.
The Act applies in full from 11 December 2027. Before its first sale in the EU, AReCoS completes the conformity assessment, publishes the EU declaration of conformity and states each product’s support period.
Show what the Act asks and how AReCoS designs to it
The EU Cyber Resilience Act, Regulation (EU) 2024/2847, sets cybersecurity requirements for products with digital elements sold in the EU. Among them, products are to be designed, developed and produced to limit attack surfaces, including external interfaces
. A controller that takes no command from the internet starts from that principle.
The AReCoS controllers and rooftop heat pump, with their optional cloud monitoring, are designed to the Act’s essential cybersecurity requirements: firmware the controller checks for the AReCoS signature before installing, the way to report a vulnerability set out below, and ten years of security updates planned for each product.
Reporting a vulnerability
Found a security flaw? Tell us.
This policy covers AReCoS products and their firmware, the AReCoS cloud monitoring service and this website.
- How to report
- Email info@arecos.net with Security in the subject line. A person reads every report. If you would like to encrypt yours, say so first and we will arrange a way.
- What to include
- The product and its firmware version, or the web address; what you found and how to reproduce it; what an attacker could do with it; and how to reach you. Send only the data needed to show the flaw.
- What happens next
- We aim to acknowledge your report within three business days, tell you whether we can reproduce the flaw, and keep you updated until it is fixed.
- Good faith
- If you act in good faith and follow this policy, we will treat your research as authorized, will not take or support legal action against you for it, and will say so if anyone asks. That covers research on AReCoS products and firmware, including a unit you own, the cloud monitoring service and this website. We cannot authorize testing of someone else’s equipment or systems, such as a customer’s installed unit.
Show disclosure, what not to do, and the rest of the policy
- Disclosure
- Please keep the flaw private until a fix is available. We will agree a date for making it public with you, normally within 90 days of your report. When the fix is released, we publish an advisory describing the flaw and how to install the fix, crediting you by name if you wish.
- Please don’t
- Test equipment you do not own or have permission to test, including units at customer sites; run tests that could disrupt a service or stop a machine heating, cooling or refrigerating; try to trick AReCoS staff or customers, or get physical access; or access, keep or share more data than you need to show the flaw.
- Rewards
- We do not run a bug bounty, but we thank everyone who reports a flaw to us.
- In the EU
- Once AReCoS products are in use in the EU, pilot units included, we will report any actively exploited vulnerability in them to the authorities, as the Act requires, and tell the users affected.
- Machine-readable
- The security contact is also published in security.txt, as RFC 9116 describes.
For IT, OT and refrigeration teams
What we agree at commissioning.
Agreed in writing with your IT and OT teams and your refrigeration contractor, then checked on site before handover.
Safety boundary
- Hard-wired safeties stayThe machine’s pressure, temperature and motor safeties stay wired and independent of AReCoS.
- What AReCoS commandsWhich actuators AReCoS sets, which signals it only reads, and which controls stay as they are.
- Setpoints from your systemsProduct and comfort setpoints, schedules and limits come from your thermostat or building system, as today.
- Handback on a faultWhich faults stop the machine through its own safeties, which hand control back to the existing controls, and how staff take over by hand. Set per site.
Security
- Network segmentationWhich BACnet or building network the controllers sit on, what may reach them, and that nothing on the internet can. BACnet Secure Connect, which encrypts and authenticates the link between units, is planned.
- Service accessWhether remote maintenance is allowed, behind which protected network, and who approves each session. No default passwords; every account has an owner.
- Signed updatesFirmware is designed to be installed on site only, never through the cloud. We check that the controller accepts only AReCoS-signed firmware and state the update support period in writing.
- LoggingWhat is recorded, where the records are kept, and who reviews them.
- RecoveryWhere settings and limits are backed up, and a restore tested before handover.
For owners comparing vendors
Berkeley Lab’s vendor security questions, answered.
Berkeley Lab’s Smarter Small Buildings campaign publishes a vendor security questionnaire for rooftop-unit controls (Appendix B). Our answers follow, numbered as there. They are ours; Berkeley Lab has not reviewed them.
- 7 · Business continuityOptimizing, fault detection and command screening run on the controller, so a cloud outage changes nothing. No AReCoS service sits in the control path. On a fault, the unit hands control back to the existing controls or stops through its own wired safeties, as set at commissioning.
- 3, 17 · Updates and firmwareFirmware is designed to be installed on site only, never through the cloud, so there are no remote firmware updates. The controller checks the AReCoS signature before installing and accepts only AReCoS-signed firmware.
- 10 · Product lifecycleTen years of security updates are planned for each product. The update support period is stated in writing at commissioning and published with the EU declaration of conformity.
- 9, 15 · Wireless and meshThe unit has no Wi-Fi or Zigbee radio, so there is no wireless or mesh network to secure. Units talk over your own wired building network.
- 12, 13 · Open protocols and dataBACnet (ASHRAE 135) at the building interface carries readings, fault flags and energy reports to your own systems. Grid requests arrive over OpenADR 2.0b or IEEE 2030.5 through your building system or a gateway (how).
- 18 · Read-only accessOptional AReCoS cloud monitoring reads and has no path to command your equipment.
- 16 · Data privacySite data does not have to leave the site for the controller to run. What AReCoS may collect, keep and use is set in writing, and pilot performance data is published only if you agree (privacy).
- 19 · Incident responseReport to info@arecos.net with Security in the subject, also listed in security.txt. We aim to acknowledge within three business days and publish an advisory with each fix (policy).
- 1, 2, 4, 5 · Access, network, logsAgreed in writing at commissioning: no default passwords and an owner for every account, what may reach the controllers with nothing on the internet, and what is logged and who reviews it (checklist). BACnet Secure Connect, which encrypts and authenticates the link between units, is planned.
Questions?
Write to us and we will answer.