19 Security, privacy, and integrity§

AGREED Escalated in v0.2 because command actions now travel.

19.1 What a package is§

A conforming package is a complete operational description of a building: its plant, topology, control points, protocol addresses, setpoints, safety limits, alarm routing, occupancy schedule, floor plan geometry — and, where actuation is present, the map by which plant can be commanded, at what priority.

That is a complete operational control kit. This standard makes packages portable. It does not make them safe to publish, and nothing here should be read as encouraging owners or vendors to treat them as ordinary documents.

19.2 Actuation§

Excluding actuation degrades the package: the receiving system will have to rebuild the command layer, which is the most safety-critical part to rebuild. The exclusion exists so that the decision is the owner’s and is visible, not so that it becomes routine.

19.3 Handling§

• A package SHOULD be encrypted in transit and at rest. Container-level encryption is not used (16.2), so protection is the responsibility of the transport and the store.
• An implementation MUST NOT include live credentials, private keys, shared secrets, or authentication tokens. Telemetry bindings carry addresses, not credentials.
• An importer MUST treat every path as untrusted input and MUST reject absolute paths and traversal segments before extraction. The ZIP container is a well-known vector for path traversal.
• An importer MUST verify digests before ingestion and MUST bound the resources it will expend, since neither entity count nor decompressed size is constrained by this standard.
• An importer MUST bound the size of an inline figure payload it will parse, and MUST NOT execute script, resolve external references, or fetch remote content from a figure. A neutral vector payload is data, not a document.

19.4 Personal data§

A building model is not intended to contain personal data, but four constructs commonly do: parties name individuals; provenance names who asserted what; knowledge notes record what individuals observed and decided; and events name who acted, at what time. Occupancy-related points and schedules can also reveal the movements of identifiable people in small tenancies.

An exporter MUST provide a means to withhold personal data and MUST declare any withholding with reason excludedForConfidentiality. It MUST NOT silently redact, because an undeclared redaction is indistinguishable to a receiver from an assertion that was never made.

NOTE This creates real tension with clause 14. Provenance is most valuable when it names a person and least compliant when it does. The standard resolves the tension by making withholding visible rather than by preferring either side; an owner configuring an export is making a judgment this document cannot make for them.

19.5 Regulatory context§

This standard is voluntary and confers no rights. Regulation (EU) 2023/2854, the Data Act, has since 12 September 2025 given users of connected products a right of access to data those products generate and a right to direct it to a third party; commentary treats building management equipment as within scope. A conforming exporter is a practical means of satisfying such a request. It is not evidence of compliance with it, and the two should not be conflated in marketing.