Product security and data

MESHLE GmbH · Last updated: 3 November 2026

This page contains the information required by Annex II of Regulation (EU) 2024/2847 (Cyber Resilience Act), by Art. 3(3)(d) of Directive 2014/53/EU (radio equipment) and by Art. 3 of Regulation (EU) 2023/2854 (Data Act) for the MESHLE GmbH products listed below.

1. Manufacturer

MESHLE GmbH
Parkstr. 42, 47877 Willich, Germany
Email: info@meshle.com · Web: meshle.com
Security reports: security@meshle.com · Data access: data@meshle.com

2. Products

This information applies to the following MESHLE GmbH products. Product name, model and firmware version are shown on the type label and in the MESHLE App.

Operating environment: commercial and residential buildings. The devices form their own encrypted radio network (Bluetooth Low Energy, 2.4 GHz). The gateway is operated in the local network of the building.

Essential functions: switching, dimming, colour and colour temperature control, scenes, schedules, sensor-based automation, remote and voice control via the gateway, connection to building management systems.

3. Cybersecurity

The security features described apply to the current software provided via the MESHLE App or the MESHLE Gateway (release notes: meshle.com/compliance/releases).

Secure by default

• No default passwords, no keys shared across devices.
• Each device has an individual identity created in production.
• A device in factory state is added to a network with the MESHLE App. From then on it is bound to that network: control and configuration only with the network key or administrator rights. It can only be added to another network after a factory reset on site. Network keys are never transmitted unprotected.

Protected communication

• Radio communication in the mesh is encrypted, authenticated and protected against replay.
• Bluetooth connections between app and device are encrypted and authenticated. Commands to commissioned devices are only executed with valid cryptographic authentication.
• Gateway and app connect to the MESHLE Cloud only via encrypted connections (TLS with server certificate validation).
• Local gateway interfaces can only be used after authentication.

Access control

• Separate roles for administrators and users. Firmware update, remote factory reset and configuration require administrator rights.
• Keys and permissions can be renewed and revoked without resetting the devices.

Protection of stored data

• Keys and access data cannot be read through radio, app or gateway interfaces.
• A factory reset deletes all keys, access data and configuration data.
• Debug interfaces and memory readout are locked on production devices.

Resilience

• Incoming data is validated; invalid data is discarded. Rate limiting and a hardware watchdog protect device and network.
• Lighting control, sensors, switches, scenes, schedules and automations continue to work locally in the mesh, even without a gateway or internet connection.

Logging

• Security-relevant events (commissioning, updates, resets, rejected access) are logged.

4. Known risks of use

• Updates not installed: known vulnerabilities remain open.
• Administrator access or network passwords passed on to unauthorised persons.
• Operating the gateway in an unprotected network or one reachable from the internet.
• Installed but not yet commissioned devices (factory state) can be added to their own network by third parties within radio range. Commission devices promptly after installation.
• Physical access by unauthorised persons to the gateway or devices.
• Passing on or disposing of devices without a factory reset.

5. Reporting vulnerabilities

Report security vulnerabilities confidentially to security@meshle.com. We confirm receipt within 5 working days and inform you about assessment and remediation.

Coordinated vulnerability disclosure policy: meshle.com/compliance/security
Machine-readable contact: meshle.com/.well-known/security.txt

MESHLE reports actively exploited vulnerabilities and severe security incidents via the ENISA Single Reporting Platform (early warning within 24 hours, notification within 72 hours, final report within 14 days after a correction is available, or within one month for incidents) and informs affected customers about impact and measures.

6. Updates and support period

Type of support: security updates are provided free of charge and without undue delay, separately from feature updates where possible, and are marked as such in the release notes.

Support period: For devices placed on the market from 11 December 2027, MESHLE provides security updates for at least 5 years from placing on the market, or longer if the expected use time is longer. The end date (month and year) is stated per product.

Installation: devices in the mesh are updated via the MESHLE App or the MESHLE Gateway, the gateway via the MESHLE Cloud, the app via the App Store or Google Play. Every firmware image is cryptographically signed and valid only for its product; older versions are rejected.

Automatic updates: are enabled by default and can be switched off in the app under Settings → Updates → "Install automatically".

Release notes: meshle.com/compliance/releases

7. Secure commissioning, use and decommissioning

Commissioning

• Set up devices only with the MESHLE App. Choose a secure network password and keep it confidential.
• Operate the gateway in a protected network segment; enable local interfaces only when needed.
• Grant administrator rights only to authorised persons.

During use

• Install updates promptly or keep automatic updates enabled.
• Changes to configuration, roles or interfaces affect security and should only be made by administrators.

Decommissioning

• Before passing on or disposing of a device, perform a factory reset; the instructions are in the datasheet or user manual of the product. The reset deletes all keys, access data and configuration data on the device.
• Delete the MESHLE account and all data stored for it: in the app under Cloud settings → "Delete account", or by request to data@meshle.com.

8. Information for luminaire manufacturers and integrators

Manufacturers who build MESHLE components into their own products receive, on request, the information for their own conformity assessment: security features, update capability, support period, firmware information for the assessment under EN 18031-1 and the software bill of materials (SBOM). Please report vulnerabilities affecting a MESHLE component to security@meshle.com.

Software bill of materials (SBOM): maintained per version; provided to market surveillance authorities on demand and to integrators on justified request to security@meshle.com.

9. Conformity

Applied legislation and standards: Directive 2014/53/EU (radio equipment) including Art. 3(3)(d) with EN 18031-1:2024, since 1 August 2025; Regulation (EU) 2024/2847 (Cyber Resilience Act): reporting obligations under Art. 14 since 11 September 2026, all other obligations from 11 December 2027.

Software security declaration and conformity documents: meshle.com/compliance/doc. The EU declaration of conformity accompanies each product.

10. Data under the EU Data Act

Data holder and contact

This information is provided before the purchase of a product or before registration of the MESHLE account. MESHLE GmbH, address see section 1. Requests for data access, sharing and deletion: data@meshle.com.

Data generated

Volume: a status message in the mesh is smaller than 300 bytes, the configuration of an installation a few kilobytes; via voice control or the gateway each command or status message is below 1 kilobyte. The total volume depends on the number of devices and on use.

Storage

The app reads device state and configuration directly via Bluetooth; account data, installation configuration and the encrypted network access are transferred to the cloud, with linked voice control also device states and control commands, and with a gateway the device states, settings and device data listed above. The app does not collect diagnostic or usage statistics.
Storage location: data centre in Germany (EU). Hosting provider: netcup GmbH, Germany. Email service: Contabo GmbH, Germany.

Access to the data

Users have free access to their data at any time, including metadata, in a commonly used, machine-readable format and without undue delay:

On request to data@meshle.com: MESHLE provides the product data and related-service data available at MESHLE (e.g. installation configuration, device states and control commands), including the relevant metadata, in accordance with Art. 4 Data Act free of charge and without undue delay in a commonly used, machine-readable format (JSON).

Users receive personal account data the same way under Art. 15 GDPR and, where applicable, Art. 20 GDPR.

Deletion

• Device and gateway: factory reset; it deletes all data stored in the device or gateway.
• App: delete networks and devices in the app.
• Cloud: in the app under Cloud settings → "Delete account", or by request to data@meshle.com; this also deletes all device data, settings and device states of the gateway. Backups and server logs are deleted after 14 days at the latest.

Use by MESHLE and sharing with third parties

• MESHLE uses non-personal data only on the basis of the contract with the user, for operation, support and security updates. The data is not sold and not used for advertising.
• At the user's request, MESHLE makes the data available to a third party named by the user under fair, reasonable and non-discriminatory terms (Art. 5 Data Act). Requests to data@meshle.com; the user can end the sharing at any time. Without a legal basis or the user's authorisation, MESHLE does not share data covered by the Data Act with independent third parties; processing by contracted service providers (hosting, email) is unaffected.
• Voice assistants and smart home platforms (Amazon Alexa, Google Home, Apple Home via Matter) receive device states and control commands only if the user links them, and only to the extent necessary. The link can be removed at any time.

Personal data

Account and location data are personal data; presence data can be. The GDPR and the privacy policy also apply: meshle.com/app-privacy-policy

Trade secrets

The data provided contains no trade secrets of MESHLE or third parties. Should trade secrets be affected in individual cases, the protective measures under Art. 4 and 5 Data Act apply.

Contract term and complaints

The contract for the MESHLE app account is concluded for an indefinite period and can be ended by the user at any time by deleting the account. The data access rights are governed by the applicable provisions of the Data Act; termination and deletion follow the terms (meshle.com/terms) and the statutory requirements.
Complaints to the competent authority under Art. 37 Data Act: Bundesnetzagentur (German Federal Network Agency).