Data Security

Last updated: 3 November 2026

This page summarizes how CoolR protects its devices, applications and cloud services, and the customer data they handle.

Refrigeration control and customer-data access

VistaZ monitors coolers and does not control their refrigeration operation, including in OEM integrations. It cannot change cooling temperatures, operate the compressor or trigger a defrost cycle. See CoolR VistaZ security facts for device details.

Cooler imagery, operational data and user accounts are protected by the safeguards below.

Customer-data safeguards

As set out in the Privacy Policy:

• All data transfers are encrypted in transit using TLS.
• Stored Client Data is encrypted at rest.
• Access is restricted by role, network location and user account.
• Infrastructure access is limited by IP allowlisting and multi-factor authentication.
• Access permissions and security posture are reviewed regularly.

Data access is limited to authorized personnel and users, and application permissions control which functions and customer/location data each user can see. See Role-Based Permissions.

Code reviews and security testing

CoolR performs regular code reviews, including reviews of device firmware. Our security work has also included customer-led penetration testing. Security findings are prioritized and tracked through remediation.

Vulnerability handling and customer communication

CoolR investigates reported vulnerabilities, coordinates remediation and disclosure, and informs affected customers of security issues that affect them.

Report a suspected vulnerability to support@coolr.ai with the subject Security Vulnerability Report. The Vulnerability Disclosure Policy covers devices and firmware, the platform, APIs and integrations, and sets out response targets and the coordinated-disclosure process.

For a confirmed personal-data breach, see the Privacy Policy's breach-response provisions.

ISO 27001 and SOC 2 Type II initiatives

CoolR is preparing for ISO 27001 certification and a SOC 2 Type II examination.

Customer security reviews

For a customer security review, contact your CoolR representative to request supporting information and non-public security policies.

Edge Devices/ VistaZ

Data Storage

VistaZ captures cooler imagery and sensor telemetry. See VistaZ device data for the data categories.

Limited Data Storage

Device data is uploaded to CoolR cloud services, where it is protected as Client Data by the safeguards above.

Data Transmission

Authenticated

Each VistaZ has its own password for local configuration, and Bluetooth configuration requires authentication as well as physical proximity. See local configuration authentication. Device communication with CoolR cloud services uses TLS.

Anonymous

Where a deployment enables collection without a user login, that workflow only uploads device data. It does not grant access to customer data in the portal.

Gateways - OS based (Global Hub)

Data Storage

Global Hub gateways collect data from authorized devices and upload it to CoolR cloud services over TLS.

Limited Data Storage

Customer, location and historical data is viewed in the portal, which requires an authorized user. The gateway's role is collection and upload.

Data Transmission

Authenticated

Gateway users sign in, and role-based permissions limit which devices they can collect from.

Anonymous

Where a deployment enables collection without a user login, the gateway can collect only from devices belonging to the same client.

Data Access

Collection permissions do not grant access to portal data. Users must be authorized to view application data.

Portal

Data Storage

Client Data is stored in Microsoft Azure (primary region USA, failover Australia) and encrypted at rest. See storage location.

Data Transmission

Authenticated

Access to the cloud portal requires authentication.

Encryption

All data transfers use TLS. Stored Client Data is encrypted at rest.

Data Access

Roles and access scope restrict the functions and customer/location data available to each user. See Role-Based Permissions.

Security Audits

See code reviews and security testing and ISO 27001 and SOC 2 Type II initiatives.