Security and privacy – specifics, not seals

Which data we process

• Account: email address, and password as a hash (bcrypt)
• Miniserver: address, user name and password. The password is stored encrypted with AES-256.
• Devices: name, room and type of the devices you allow
• Link with Alexa: an access token. We never learn your Amazon password.
• Payment: subscription status and customer number at Stripe. Card details are processed by Stripe alone.

Where the data is kept

Our servers are in Germany (Hetzner, Nuremberg). Speech processing is done by Amazon. The part of our service that receives commands from Alexa runs at Amazon Web Services in the EU (Ireland region).

Access rights

Create a separate user for MFM Voice in the Miniserver and give it access only to what Alexa should control. In MFM Voice you also select each device individually. A Miniserver can only ever be connected to one MFM Voice account.

Connection to the Miniserver

MFM Voice always tries the encrypted connection (HTTPS) to your Miniserver first. It is available with Loxone Remote Connect, Loxone’s remote access service, and no port has to be opened on the router. If your Miniserver does not offer HTTPS, only an unencrypted connection is possible. We do not recommend that.

Doors, gates, alarm system

Alarm systems and intercoms cannot be controlled by voice with MFM Voice. You can allow a gate; there is no PIN prompt for it. Our advice: only allow voice control for what a guest in your home would be allowed to operate.

Cancellation and deletion

Your data stays saved as long as your account exists. You can remove a connected Miniserver yourself in MFM Voice at any time; its connection data and device list are deleted with it. We delete your account on request to support@mfm.energy. We keep invoices for as long as the law requires.