Security, clearly explained.

The GEM controller executes core automation on premises. If internet connectivity is lost, schedules and local control continue while cloud-based conveniences such as remote access are unavailable.

Direct communication between GEM and supported devices happens on the property network, reducing the amount of routine system traffic that needs to involve cloud services.

When remote access is selected, users authenticate before traffic is forwarded to the property. Two-factor authentication can be enabled for cloud accounts.

The controller and cloud service use signed credentials to authenticate supported connections, and credentials can be revoked when access changes.

Update packages are encrypted and checked before they are applied. License and entitlement responses are cryptographically signed for verification by the controller.

When supported account and access-profile data sync between sites, it is encrypted end to end before passing through the relay service.

For deployments using cloud backup, encrypted configuration snapshots can be stored off site and restored when recovery or replacement hardware is needed.

GEM’s interfaces, API, and camera streams always require a signed-in session, and there is no setting that turns this off. Real-time connections from other websites are rejected, and the default administrator must set a new password at first login.

Device passwords, API keys, and private keys stored by GEM are encrypted with AES-256-GCM using a key generated on the controller.

Roles grant or deny access to individual interfaces, pages, and API functions, and a deny always overrides an allow. Remote access and elevated administration are separate switches per role, so staff, tenants, family members, guests, and contractors reach only the systems relevant to them.

For sites that cannot reach the internet, GEM can be configured to make no outbound connections at all. Signed licenses continue to verify locally; remote access, online updates, and cloud backup are unavailable in that mode.