Product security
TeaCup devices sit in people’s homes, so we treat their security as part of looking after the people who live there. This page explains how to tell us about a security problem and how long we will keep the devices up to date.
How long we provide security updates
We will provide security updates for the TeaCup hub, room sensor and smart plug, and for the TeaCup apps and service they rely on, for as long as TeaCup is in service, and in any case until at least 31 December 2036.
Updates are delivered automatically over the internet. You do not need to do anything to receive them. If we ever extend this period we will update this page; we will never shorten it.
How to report a security problem
If you think you have found a security weakness in any TeaCup device, app or service, please email hello@triform.digital with “Security report” in the subject. You do not need an account, and you do not need to give us any personal details beyond an email address to reply to.
It helps us if you can tell us which product is affected, what you found, and how we can see it for ourselves. Please give us a reasonable chance to fix a problem before telling anyone else about it.
What happens next
- We will acknowledge your report within 5 working days.
- We will then send you an update on our progress at least every 30 days until the problem is resolved.
- When it is fixed, we will tell you, and we will credit you for finding it if you would like us to.
How the devices protect themselves
- No two devices share a password. Each one creates its own when it is first switched on.
- A device will only install software that TeaCup has digitally signed. Anything else is refused.
- The hub talks to our service over encrypted connections.
TeaCup is made by Triform Digital Limited, registered in England and Wales, company number 16368540. This page is our published information under the Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023.