Can Singer Intelligent Homes get into my Charyl box?

Yes, in a few specific ways. Here’s every one we know of, so you don’t have to guess.

Your box doesn’t open a port on your router. Your phone reaches it through a connection the box opens out to our relay, and that connection is also how Charyl Cloud reaches your box.

Our relay carries your sign-in. Whenever you use the mobile app, at home or away, your phone’s sign-in travels through our relay with each request. So your box can’t reliably tell a request we send from one your phone sends. That goes for every part of the app, cameras included, and we could see the answers. The only requests we send with your sign-in are Charyl’s, described next — but that limit is our policy, not something the box enforces. It’s also why the approvals and confirmation taps you give in the mobile app rest on our policy too: they travel the same way. (Approving a support request in the web app at home goes straight to the box.)

Charyl’s tools, through Charyl Cloud. When someone in your household chats with Charyl and her thinking happens in Charyl Cloud (as it does when you chat from the mobile app), she reaches back into your box to look things up and to act. She uses the same tools she uses in a conversation, with that person’s permissions.

The box refuses a sign-in that’s been signed out or belongs to an account that’s been disabled or removed. It doesn’t check that a conversation is going on, or where Charyl Cloud got the sign-in. Each copy of a sign-in we see works for up to eight hours, but a fresh one comes through our relay every time the app is used. So Charyl Cloud could keep running those tools, and seeing what they return, for as long as that person stays signed in — at most 30 days after they signed in, by default. An admin signing that person out everywhere, in the web app at home, stops it until they sign in on a phone again (by typing their password, or automatically on a phone that still stores it). Only disabling or removing that person, in the web app at home, reliably stops them signing in again. Signing out in the mobile app stops it only if our relay delivers that request. Keeping this to your conversations is our policy, not something the box enforces.

Through Charyl Cloud’s tool channel, changes that need your confirmation can’t be made at all. Elsewhere, the confirmation tap itself travels through our relay, so that it really came from you is our policy too. And not every change needs one: saving or deleting what Charyl remembers, snoozing doorbell notifications, and for an admin, bringing in new devices from Home Assistant, along with their automatic rules, or some setup steps.

Software updates. The appliance ships with Charyl Cloud, and with it, releases we publish apply themselves in a maintenance window, health-checked, with automatic rollback. An update runs with full control of the box, so an update we publish could read or change anything on it. That’s the trade for a box that stays patched without you doing anything.

Which release your box gets. We can also choose the release for one particular box, holding it back or moving it to an earlier or later one, without asking you first. That’s how we’d take a single home off a bad update. It only ever picks from releases we’ve published.

Support requests. Support can send your box a request to restart one of its services, check for updates, or send us a health report. Nothing happens until an admin of your home approves it — and as above, an approval in the mobile app travels through our relay.

Health reports. Your box can also send us a short report on how it’s running, every hour: software versions, whether each service and integration is running, storage and memory headroom, and the results of recent updates and backups, with none of your home’s content. It’s on by default, you’re told about it during setup, and an admin of your home can turn it off in the web app’s settings.

Our repair key. Every box we set up carries a login key, made for that box, that we keep for repairs. A box may also accept other keys we hold: that applies to boxes set up before we tighten how boxes are set up, until they’re set up again. The box accepts these keys from any network that can reach it. Most home routers stop connections like that from the internet, but the box doesn’t block them itself. So anyone holding a key, on your home network, on the setup Wi-Fi the box raises when it can’t find yours, over a USB setup connection, or on the internet if your router lets the connection through, can sign in to the box.

A support session you’d open yourself, for hands-on repairs, is planned but not built.

If a box is sent back to us for repair, we can read what’s on it, because the disk isn’t encrypted at launch — so we wipe returned boxes when they arrive. Disk encryption is planned.