OUR TECHNOLOGY

arloid.ai integrates with all components of HVAC (Heating, Ventilation & Air Conditioning) infrastructure, incl. chillers, AHUs, cooling towers, FCUs, pumps, fans, VAVs, VFUs etc. For successful deployment, we require connectivity to either BMS or a centralised HVAC control system. BMS and building managers will retain full control and access rights for all HVAC devices.

We examine connectivity for HVAC systems and all relevant devices during site assessment and before the simulation phase.

The actual savings on monthly basis may vary due to constantly changing external environmental conditions. However, the actual savings over the period of 12 months will be very close to the simulation results.

Yes, site operations team retains full control of individual devices and is able to manually overwrite the suggested by AI settings. This can be done either through Arloid Dashboard or through the existing Building Management System.

No, arloid.ai connects to the existing BMS (Building Management System) and works alongside it.

• Technical & Organisational Measures

  ISO27001 Compliance

  In alignment with the ISO27001 standard, we are committed to following best practices and have implemented all the necessary measures such as regular vulnerability management and patching, staff access control reviews, defined segregation of duties and privacy by design amongst all other principles.

  Data Protection Regulation Compliance

  In compliance with the local data protection regulations of each country Arloid is providing services in, we adhere to the local authorities’ guidance by storing customer data locally and ensuring we comply with each country latest Data Protection requirements.

  Data Privacy Impact Assessments (DPIA)

  A Data Privacy Assessment (DPA) is conducted as a part of each new customer site connection to ensure we utilize the most secure and efficient option.

• Data transfer and storage

  IPsec tunnel

  The communication channel between the arloid.ai cloud and client site is established over IPsec (Internet Protocol Security) – a secure network that provides encrypted communication between the site and arloid.ai cloud. The channel is deployed in virtual private network (VPNs) environments.

  Cloud security

  Output data from the client’s HVAC systems is stored in the arloid.ai cloud, with security measures implemented by Arloid’s cloud service provider, including multi-factor authentication for the servers that host arloid.ai. We use hyperscalers (AWS, Microsoft Azure or Alibaba Cloud) to deploy our platform in the best environments available in each region.

  In order to gain access to the data, Arloid employees are required to gain access through “root” credentials, replace/find unique VPN client credentials and to identify the right instance. The access rights are provided for a predefined time period to ensure compliance with security measures. Access monitoring tools are also in place.

• Data access by Arloid

  Anonymised data

  We assign a uniquely generated Site ID (“sid”) to each site dataset. The data and the reference to the client site are stored in segregated sources to prevent data breach.

  Segregated storage

  We use segregated storage for testing and for live client data to mitigate risks. Live client data is stored in the Production environment while the Development environment is used for test data. Access to client data is restricted and governed by Arloid internal policies, which require approval from the company senior management and the head of IT department.

  Data backup

  Data backup and data recovery procedures are performed on regular basis by our IT support. In order to comply with our internal policies, these processes are reviewed on a regular basis.

• Simulation Phase

  One-way data flow

  During simulation phase, we establish communication channel with the client site with read-only access to collect the site data. All interfaces and code transmitting commands for the site remain inactive during this period.

  Restricted access

  Access to the AI simulation results is restricted and available only for our account/sales team. Access rights to each site data set are governed by our internal policy to ensure the client data safety and confidentiality.

  The Sales team are only granted visibility to their assigned customer accounts on the Arloid Dashboard

  Additional measures

  Our comprehensive security includes additional measures to protect direct access to data or web server gateways. Our security policy requires both, whitelisting of the IP address as well as obtaining security key. We review our policies on a regular basis in order comply with the information security requirements.

  Commercial Phase

  The below measures are in place for our SaaS solution:

  • Arloid has developed user access to the dashboard with varying levels of access depending on the agreed access control with the client.
  • The only authorised users from Arloid with “Manager” level access to the Dashboard is the support team.
  • Audit logging is in place which captures user IP Address, Geo-location, Date & Time of all activities.
  • User authentication mechanisms are in place to lock user accounts after 5 consecutive failed login attempts.
  • Email invitations are sent to all new users which allows the new user to create a suitable password before being able to log into the Dashboard. Only users with “Full Access” permissions from the clients team is able to send new user invitations.
  • All systems implemented as part of our SAAS solution is hosted within a load balanced and high availability environment

We do not connect directly to the BMS unless API functionality is configured and made available to Arloid. In most cases we connect at the lower level to the BMS router/switch that communicates with HVAC infrastructure using standard protocols such as BACNet, ModBus, LonWorks, etc. Using this approach ensures that we do not modify any configurations of the BMS system. We do not make any modifications to the customer HVAC controllers neither.