Secure by design.
And we can show you.
Centro is designed to meet the EU Cyber Resilience Act. This page sets out what the Centro Box does to protect a building, how we build it, and how to tell us about a security problem. Ask us for the evidence behind any of it.
The Centro Box
Protected from the first minute
Secure by default means safe the moment it is installed, not after someone remembers to harden it.
Runs in the building
The Centro Box runs on the Crestron processor on site and works without the cloud. Guest and room data stay in the building, on hardware the property controls.
Encrypted connections, both ways
The staff and guest apps are served over HTTPS by default. Connectors must also present their own certificate (mutual TLS), so a device on the network cannot pretend to be one.
No shared default password
Staff sign in with the processor's own accounts. An account locks after five failed attempts.
Every API route checked on every build
An automated test calls every route in the box API on every build and fails the build if any route lets in someone without the right access.
Secrets kept secret
Stored credentials are encrypted and never sent back by the API. Key files can be read only by the Centro program. Every downloaded backup needs a passphrase and is encrypted with AES-256-GCM.
Browser protections
The admin pages send a Content Security Policy and anti-framing and content-type headers, which block whole classes of web attack such as clickjacking.
A clean hand-over
A factory reset wipes the site's data when a processor changes hands.
Security updates for five years
Every Centro Box gets security updates for five years from purchase, the same promise as on our licences.
How we build
We know what we ship
Most software is built from other people's software. We keep track of every part of it.
- A software bill of materials (SBOM) for every Centro Box release, covering the engine, the staff app, the guest web app and the Crestron Home driver. Available on request.
- Every build checks every component against public vulnerability databases, and fails on any known High or Critical vulnerability.
- Automated dependency updates (Dependabot) on our code, so fixes from the projects we build on reach us quickly.
- Automated tests run on every change before it can be merged.
- We attack-test the Centro Box in-house with our own test harness.
Report a vulnerability
Found a security problem? Tell us.
Email our security team. Our security policy says what happens next and how we work with you.
Machine-readable contact details are in our security.txt.
The Cyber Resilience Act
On our way, in the open
The EU Cyber Resilience Act sets security rules for products with digital elements sold in Europe. Its vulnerability reporting duties have applied since 11 September 2026, and the rest applies from 11 December 2027.
We have built Centro with security at its core from day one. We are designing it to meet, and go beyond, the Act and the security frameworks being adopted around the world, as they evolve.
Read the article series on our road to the ActFor installers
What only the installer can do
Security is shared between the product and how it is installed. We would rather say so plainly.
Put building controls on their own network
Some lighting hardware Centro connects to, such as Mode NPUs, can only talk unencrypted. That is a limit of the hardware. A separate control network keeps that traffic away from guests.
Protect the processor's admin accounts
They are the keys to the building's controls. Use strong, unique passwords and don't share them.
Keep the box up to date
Security fixes only help once they are installed. Check for a new Centro release when you service a site.
Centro is made by SI Sound and Light Ltd, trading as LCD, 4 Lothian Bank, Eskbank, EH22 3AN, Scotland. This page covers the Centro Box. It does not yet cover the Centro cloud platform.