Security overview

iRis Cloud provides multiple layers of security for platform access, user authentication, HMI Device connectivity, and audit visibility. This page summarizes the main mechanisms and links to related guides.

iRis Cloud authenticates users via username and password by default. When additional sign-in protection is enabled, users may also complete a two-factor authentication step.

Method	Description
Username and password	Default sign-in method.
Two-factor authentication	Adds a second verification step after entering credentials where email 2FA is enabled or required. See Two-factor authentication.

Applications and scripts authenticate to the iRis Cloud API using JWT tokens:

Method	Description
JWT tokens	Obtained by calling the login endpoint with username and password. Tokens expire periodically and must be refreshed.

Use the HTTPS URL provided for your iRis Cloud deployment when accessing the web UI and REST API.

Each device connectivity protocol supports encrypted transport and one or more authentication methods. For HMI Device connection setup paths, see How to Connect iRis HMI Devices.

Protocol	Encryption	Authentication methods
MQTT	TLS (port 8883)	Access Token, MQTT Basic credentials, X.509 certificate

For TLS/DTLS-based transports, one-way TLS/DTLS lets the client verify the server. MQTT also support mutual TLS, where both sides authenticate using X.509 certificates. For fleet provisioning, you can use certificate chains so that HMI Devices sharing a common CA are automatically trusted. SNMPv3 uses USM authentication and privacy passphrases for encrypted transport.

Topic	Description
Audit log	Track user actions across the platform for compliance and troubleshooting. See Audit log.