Encrypted: for data that’s someone’s business

Encrypted is the Enforce TLS switch (enforceTls), per device, and it is not a level: you can turn it on at Open, Token or Signed. With it on, the endpoint refuses plaintext at the door and the payload is unreadable on the wire. Today that means HTTPS or MQTTS — port 8883 on the same broker as 1883 — and TLS-wrapped TCP, which is planned and does not serve yet.

Two questions, two switches

Levels answer who is allowed to send. This switch answers who can read it. They are independent, and neither contains the other: against a network attacker, encryption wins; against a token leaked into a proxy log, a signature wins, because the attacker still doesn’t have the key. Keeping them apart means you buy an HMAC implementation only if you need integrity, and a TLS stack only if you need confidentiality.

Which matters, because of the five ways into Warblet — https., http., mqtt., tcp. and udp. — two can carry TLS: https. always, and mqtt. on port 8883. The rest still get the full auth ladder, and cannot be encrypted.

What it buys you

Confidentiality, once it’s enforced. Two different things are at work here: a TLS connection encrypts your traffic, and this switch is what rejects the plaintext ones. With it off nothing is refused, so a device that falls back to a plain endpoint — a firmware bug, a roaming board, an old build still in the field — is readable on the path and still accepted. With it on, every message we hold either crossed an encrypted wire or never arrived, and an observer learns only that something talked to Warblet. This is the floor for business data, customer sites, and anything with a privacy expectation.

The one-click case: a fleet that already speaks HTTPS gets guaranteed encryption the moment you arm this, with zero key distribution and no firmware change. An MQTT fleet is one line away from the same thing — the port.

You turn enforcement on when the firmware is ready

Off is the default, and that is deliberate: it is a debugging aid. Point the device at the TLS endpoint and the platform shows you exactly what arrives — over TLS or in the clear — without going dark while your firmware settles. When its messages are confirmed arriving over TLS, flip the switch: from that moment plaintext is rejected at the door and not stored. Before you flip it, the portal says the plain truth on the device — TLS observed · not enforced — and does not claim a confidentiality it isn’t enforcing.

You can arm it before the evidence arrives — the portal asks you to confirm rather than stopping you, because it is your firmware and you may already know what it sends. If the device is still posting in the clear, every packet is refused from that second; turning the switch back off is the way out. The one combination the API turns down outright is arming it on a spec that declares TCP or UDP: there is no TLS listener there at all, so the switch would silence the device permanently while claiming to secure it. MQTT left that list when 8883 opened — an MQTT device armed while it is still on 1883 is refused at ingest, which is the flag working rather than a trap, and it is one port away from satisfied.

How to protect yourself on the wire

Have a clock. TLS certificate validation needs roughly-correct time; battery devices that sleep for weeks should NTP-sync on wake before connecting (or you’ll debug “works on bench, fails in field” for a day — ask us how we know).
Budget the RAM. An ESP32 does TLS comfortably; an ATmega does not. If your MCU can’t, remember that’s exactly the gap Signed exists to fill — integrity on a plaintext link, no TLS stack required.
Pin our CA, not our certificate. Certificates rotate; the CA doesn’t. Firmware that pins the leaf cert bricks its connectivity on our next renewal.
Encryption is not authentication. An unreadable message from the wrong sender is still the wrong sender. At Open with this on, anyone who learns the hardware id can still post as your device — over a link nobody can read. Pick the level as well as the switch.
It protects the pipe, not your account: portal password hygiene and rotating device credentials for decommissioned units still matter.

The quiet upside

Nothing about your dashboard, decoders, or routines changes when you arm this — the switch only changes what the transport demands. Prototype naked on the bench, enforce TLS across the fleet for the customer install, and the cloud side of your project doesn’t notice. The device does: the clock, the RAM and the pinned CA above are firmware work.