Security
Interval electricity data shows when you wake up, when you leave, and when you are away for a week. We know what that means, and we built accordingly.
This is the single most important thing about how Connect works. Authorization runs through UtilityAPI's hosted flow against your utility's own login. There is no field anywhere in this product that asks for a utility password, because we have no use for one and no desire to carry that risk.
The permission you grant is scoped to specific accounts and has an expiry date. You can end it from your settings or from your utility's website at any time, without contacting us. We warn you by email before it lapses on its own.
All traffic runs over TLS. Data at rest is encrypted by our database provider. Passwords are stored only as salted cryptographic hashes and session cookies are HTTP-only, so no script on any page can read them.
Fifteen-minute readings can suggest when a building is occupied. We use them for one thing — the analysis you asked for — and never to infer anything about you for anyone else's benefit.
Every third party that processes customer data is named on our subprocessors page, along with what they receive and why. If a provider is not on that list, your data does not reach them.
Export everything we hold in one click, or delete the account entirely. Neither requires emailing support, waiting on a ticket, or explaining yourself.
Reporting
If you believe you have found a vulnerability, email security@growpros.com. Tell us what you found and how to reproduce it. We will acknowledge within two business days and keep you updated until it is resolved.
Please do not run automated scans against production or access any account that is not yours. We will not pursue action against good-faith research that respects those two limits.
Our privacy policy lists every field we collect and exactly why.