Secure-by-Design and Secure-by-Default are the fundamental principles of our product and service security.
Data Security Trust Model by Tuya
Tuya's Security Trust Model is built on a foundation of a professional security team and a comprehensive security framework, encompassing multi-layered protective measures. This model covers key areas such as physical security, network security, software security, data security, Identity and access management, compliance auditing, and business resilience. By integrating these elements, Tuya has established a robust security ecosystem that provides reliable security assurance for users and businesses worldwide.
Tuya Information Security Mission
Tuya is dedicated to providing consistent, reliable, secure, and compliant IoT access services, ensuring the availability, confidentiality, and integrity of data for customers and their users. With a core focus on data protection and cloud security capabilities as its cornerstone, Tuya leverages its unique IoT solutions to build industry-leading competitiveness, establish a comprehensive cloud platform security assurance system, and consistently prioritize information security as a key development strategy for Tuya Cloud.
To achieve these goals, Tuya implements multi-level security protections, including security checks, defenses, monitoring, and audits for all external services, forming a comprehensive process of preemptive, ongoing, and post-event protection. Additionally, by establishing a complete security system within the software and hardware development lifecycle, Tuya seamlessly integrates information security and compliance guarantees into every aspect of software development engineering management, ensuring the security and quality of the final delivered software and hardware products.
Comprehensive Defense in Depth
Tuya Cloud has a mature, multi-layered network security defense architecture, providing comprehensive protection across network, server, application, and code layers with fine-grained security measures. Key security capabilities include WAF (Web Application Firewall), RASP (Runtime Application Self-Protection), CNSPs (Cloud Native Security Platform), HIDS (Host Intrusion Detection System), HoneyPot, SIEM (Security Information and Event Management), and various business security applications and components. These multi-layered protection mechanisms are designed to identify and respond to various threats from the internet across multiple dimensions and levels in the technical architecture.
Rigorous R&D Security
Tuya strictly follows the Secure Development Lifecycle (SDL) methodology to develop cloud, app, and smart device services and products, aiming to integrate information security into the entire software development lifecycle. Tuya's secure development lifecycle comprehensively covers all stages of the system development lifecycle, including but not limited to security controls during the review, development, testing, release, and deployment phases.
Robust Data Security
Tuya has built a comprehensive and systematic data security framework. This framework, from the perspective of the data security lifecycle, utilizes both management and technical measures to ensure that data is rigorously managed and controlled at every stage, including collection, storage, processing, transmission, sharing, and deletion. Through this system, Tuya provides solid data security assurance, ensuring the integrity, confidentiality, and availability of user data.
Reliable Product Security
Tuya's smart hardware solutions are built on end-to-end security authentication and encryption, ensuring reliable device authentication, secure communication, firmware protection, system security, and OTA security. Additionally, these solutions have obtained various global information security audits and certifications, including but not limited to RED DA, PSTI, EN303645, NIST8259, PSA, and other authoritative security certifications for smart products.
Tuya Security Partner
Tuya is committed to protecting user data and system security by establishing close partnerships with industry-leading security partners, continuously safeguarding business security.
Tuya Bounty Program
Tuya works together with security researchers to build a healthy IoT ecosystem. When researchers identify potential vulnerabilities in the Tuya IoT PaaS and its products and services, we encourage them to report them to us through our bug bounty program.
