The trace: one door event followed from the front entrance to the cloud

Stop 0 · Front entrance, ground floor

Smart lock and reader

Front entrance, 07:42. A credential is presented at the reader on the front door. The door unlocks. One small record, a door event, is created, and the trace follows it until it reaches the last place it goes.

Here it becomes A credential read and a decision requested.

A door that reports and obeys: state, events, commands.

Held by

Maker A The steward

Owed here

• The data your building makes is yours to take. Art. 4
• New devices must be born open. Art. 3

To ask · Cyber Resilience Act

What is the declared support period for each device — and how do security updates reach a controller that never touches the internet?

Stop 1 · Riser cupboard, ground floor

Building controller

Here it becomes A decision and a line in the controller's event log.

The deterministic heart: schedules, interlocks, decisions — online or not.

Held by

Maker B, a shared platform The steward

Owed here

• New devices must be born open. Art. 3

To ask · Cyber Resilience Act

What is the declared support period for each device — and how do security updates reach a controller that never touches the internet?

Stop 2 · Comms room, level 2

On-prem server (head-end)

Here it becomes A row in the system of record, joined to a person and a tenancy.

The building's system of record, inside the building.

Held by

Software brand C The steward

Owed here

• The data your building makes is yours to take. Art. 4
• The event log isn't their database — it's your data. Art. 43

To ask · NIS2

Ask yourself first: are we an essential or important entity? Then ask the vendor for the supplier-security evidence your own regulator will one day ask you for.

Stop 3 · A data centre

Cloud service

Here it becomes A replica, and a backup of the replica.

The hosted 'server': multi-site views, remote management — talking down to your controllers.

Held by

Software brand C and Hosting provider D The steward and Hosting provider D

Owed here

• The data your building makes is yours to take. Art. 4
• You can send it to anyone — even their competitor. Art. 5 · Art. 6
• Leaving is your right — and the exit fee is dying. Art. 23 · Art. 25 · Art. 29 · Art. 30
• Take-it-or-leave-it data clauses can't bind you. Art. 13 · Art. 8 · Art. 9
• Your data can't be quietly reached across borders. Art. 28 · Art. 32
• The event log isn't their database — it's your data. Art. 43

To ask · SOC 2 · ISO/IEC 27001

Which of the services my building depends on are inside the ISO 27001 scope or the SOC 2 report — and can I read the report under NDA?

Stop 4 · A model provider

Cloud AI

Here it becomes A model input, possibly training data.

Portfolio-scale models: benchmarking, forecasting — fed by your building.

Held by

AI provider E The steward and Hosting provider D

Owed here

• Leaving is your right — and the exit fee is dying. Art. 23 · Art. 25 · Art. 29 · Art. 30
• Your data can't be quietly reached across borders. Art. 28 · Art. 32

To ask · EU AI Act

Which risk class does each AI feature fall into, who holds the conformity obligations — and does anything here watch, identify or score people?

Stop 5 · Wherever the recipient is

Third party (your choice)

Here it becomes A copy delivered at the owner's request.

A recipient the building's owner designates: an energy optimiser, an analytics firm, a consultant, or the vendor's competitor.

Held by

Recipient R, the owner's choice Recipient R, the owner's choice — chosen by the owner

Owed here

• You can send it to anyone — even their competitor. Art. 5 · Art. 6

To ask · GDPR

Which of this system's data classes are personal data, who is controller and who is processor for each — and where is the processing agreement?