MiBa Solar privacy and security

Credentials and tokens

• Your Deye password is sent server-side to Deye for authentication and is not retained after sign-in completes.
• The SHA-256 password representation required by Deye is also treated as a secret and discarded after the login transaction.
• MiBa Solar stores your email after a successful sign-in and records email snapshots with API request usage for private operator reporting. Detailed request records are retained for seven days; daily summaries cover the current month and the preceding twelve months.
• Deye access tokens are encrypted at the application layer with AES-256-GCM and versioned server-side keys.
• Tokens, application secrets, encryption keys, and database credentials never belong in browser-visible session data.
• When Deye access expires or is rejected, MiBa Solar requires credential re-entry instead of storing a password for automatic renewal.

Account and station isolation

MiBa Solar uses internal IDs for application routes. A station or device identifier supplied by the browser is input, not proof of access. Protected reads, reports, exports, refreshes, and preferences start from a verified session and resolve the requested station through the active Deye connection.

Tenant-scoped cache and snapshot identities include the connection and internal station so the same external Deye identifier cannot cross account boundaries.

The read-only boundary

Version 1 calls monitoring endpoints. It has no inverter controls, configuration saves, device registration, station creation, deletion, or strategy operations. Refreshing or rendering data cannot become a hidden write operation.

Product analytics

When the production analytics switch is enabled, MiBa Solar automatically records an approved set of sanitized route and product events. Autocapture, session replay, exception autocapture, raw URL capture, and form capture are disabled.

Analytics must not contain raw solar telemetry, report rows, credentials, share tags, station or device identifiers, customer metadata, query-bearing URLs, or raw errors. Authenticated use is associated with the internal MiBa Solar user UUID; a successful Deye email login may set that email only on the external analytics person profile.

Public dashboard responsibility

A public dashboard link deliberately works without viewer login. Anyone with an active URL can see the limited dashboard data for that link until its owner deletes it. Public links do not expose credentials, reports, exports, devices, Settings, or the owner's other stations.

Equipment and electrical safety

MiBa Solar help explains monitoring data, not hazardous electrical work or equipment configuration. For wiring, firmware, inverter alarms, BMS communication, battery configuration, work modes, or grid settings, use the correct manufacturer documentation and contact the installer or another qualified professional.