Security & Privacy
Self-hosted by design
Your Home Assistant credentials and dashboards live only on the server you run CasaBoard on. There are no CasaBoard servers in the picture at all.
Your Home Assistant credentials never leave your server.
This isn't a policy promise — it's the way the software is built. There is no CasaBoard backend to send data to; the only network endpoint the app talks to is the Home Assistant instance you configure.
Stays on your server
Everything, always
- Home Assistant URL and access token
- Dashboard, sidebar, and theme layouts
- All stored as JSON files on your mounted data volume
Stored by CasaBoard (the maintainers)
Nothing — there is no hosted service
- No accounts
- No dashboard data
- No Home Assistant credentials
When you open a dashboard, the CasaBoard server opens a WebSocket directly to your Home Assistant instance. Live entity data flows between the two — there is no third server anywhere in between.
CasaBoard container
Runs on your network
WebSocket
Direct · no proxy
Your Home Assistant
On your network
There is no third party in this diagram. The maintainers have no route to intercept or read live entity data from your home.
There is no login screen
CasaBoard doesn't implement user accounts. Anyone who can reach the app over the network can view and edit dashboards — the same trust model as Home Assistant itself when accessed directly.
Restricting who can reach it is therefore a network-level decision: keep it on your LAN, put it behind a reverse proxy with its own auth, or expose it only through the HACS panel embedded in your already-authenticated Home Assistant session.
Recommended setups
- Run it on a trusted home network only
- Put a reverse proxy with auth in front if exposing it externally
- Embed it via the HACS panel so it's only reachable through Home Assistant's UI
Questions about security?
Found a potential issue, or want a deeper technical explanation of any of the above? Reach out directly.
Last reviewed July 2026.