As building systems become more connected, cyber security has moved from a background concern to a front-of-mind requirement for building operators and their IT teams. Any platform that connects to a building’s electrical infrastructure and communicates with external cloud services needs to be designed with security as a core consideration. This article explains how the Better Balancer platform is architected to protect your building’s network and your data.
The Better Balancer platform: two components, one secure system
Better Balancer consists of two main components that work together: an on-site Edge Compute controller and the Better Balancer cloud management platform.
The Edge Compute controller is a Linux-based device installed on-site at your building. It connects directly to your electricity meters and related building systems, collects real-time energy consumption data, runs the load balancing algorithms that manage EV charger power limits, and sends operational data securely to the Better Balancer cloud platform.
The Better Balancer platform is hosted in a secure cloud infrastructure environment. It provides the user-facing management interface, handles user authentication and access control, stores operational data, and enables additional system integrations.
Understanding how these two components communicate and how that communication is controlled is central to understanding Better Balancer’s security posture.
Network security: outbound-only by design
One of the most important security characteristics of the Better Balancer platform is how the Edge Compute controller communicates with the cloud.
The edge device initiates all connections outbound from your site, and it never accepts inbound connections from the internet or from the Better Balancer cloud platform. This means your IT firewall configuration does not need to open any inbound ports to support Better Balancer operation.
For building operators and their IT teams, this is important to ensure the attack surface of your IT network remains the same as it was before Better Balancer installation. Your existing firewall policies are not weakened in any way.
The edge device communicates using secure protocols. HTTPS and MQTTS are used for real-time operational data such as meter readings and load control signals, while SSH allows component updates and remote edge controller configuration.
X.509 certificates: mutual authentication explained
HTTPS, SSH, and MQTTS connections are secured using X.509 digital certificates.
An X.509 certificate is a digital credential similar in concept to a passport that proves the identity of a device or system. When the Better Balancer edge device connects to the cloud platform, both sides present their certificates to each other and verify them before any data is exchanged. This process is called mutual authentication.
This prevents man-in-the-middle attacks, where a malicious party attempts to intercept or tamper with communications between two systems.
Identity and access management
User access to the Better Balancer cloud management platform is protected through two complementary mechanisms.
OAuth 2.0 Single Sign-On (SSO) allows organisations with an existing corporate identity provider such as Microsoft Entra ID, Okta, or similar to integrate Better Balancer authentication directly into their existing SSO framework. Users log into Better Balancer using their corporate credentials, and access is governed by the same identity policies your IT team already manages.
Multi-Factor Authentication (MFA) is available for customers where OAuth SSO integration is not required. MFA requires users to verify their identity through a second factor in addition to their password. This significantly reduces the risk of unauthorised access in the event that login credentials are compromised.
Together, these two mechanisms ensure that access to Better Balancer’s management platform is controlled and aligned with modern enterprise security expectations.
A note for IT teams
- No inbound firewall rules are required.
- All external communication is initiated by the on-site edge device over encrypted protocols.
- Mutual certificate-based authentication prevents unauthorised connections in both directions.
- SSO integration allows Better Balancer to sit within existing corporate identity management frameworks.
- MFA is available for all non-SSO deployments.
IT and security teams with specific questions about Better Balancer’s platform architecture, certificate infrastructure, or data handling practices are encouraged to contact Better Balancer directly.
Related articles
How Better Balancer Gives Every Charger Operator Visibility and Control — Automatically
How LMS Sharing and software integrations give charger operators real-time visibility of their power limits while the building owner retains control of supply limits.
The Hidden Electrical Challenge Facing Multi-Tenant Buildings — and How Facilities Managers Are Solving It
EV charging is becoming a tenant expectation, but multi-tenant buildings need an electrical coordination model that works across independent charger systems.
Power, Phases, and EV Chargers: What Every Building Operator Should Know
A practical primer for building operators on single-phase and three-phase charging, switchboards, phase imbalance, and why smart load management matters.