Leave Your Message
Firmware, App Ecosystem and Data Privacy: What Smart Lock Distributors Must Lock Down Before Private Labelling
Three Thousand Locks and One Dead App
A smart home distributor in Madrid private labelled 3,000 Smart Locks in March and sold out by July. The following spring the factory stopped updating its app, the SDK licence expired, and every end user lost the ability to add a fingerprint or a guest code. The app still opened. It just could not do anything.
The fix was a mainboard swap on 2,100 units at roughly 34 euro each in parts, labour and freight, plus a warehouse of returns. The contract covered hardware warranty for two years and said nothing at all about software.
The recall was the smaller problem. The larger one was the loss of the second order: the same operator had planned 1,400 more units for the next phase and moved to a competitor who could show a signed software maintenance schedule.
Firmware Maintenance Is a Contract Term
Start with a number: how many years of firmware support are committed, in writing, from the last shipment date. Then define the mechanism: over the air updates, a batch upgrade path for installed fleets, and who pays mobile data. Face models need periodic retraining and larger images, so an OEM facial recognition camera smart lock is the most update hungry product you will carry.
Then write the exit clause. Require at least twelve months notice before any app, cloud service or SDK is withdrawn, and require source code or an escrow arrangement if the factory will not commit beyond that. Confirm in writing that the cloud licence transfers with the goods, not with the account of whoever paid.
Choosing the Ecosystem: Tuya, TTLock or Your Own
Three options exist and they behave differently after year two. A Tuya Wi-Fi smart lock plugs into a huge device ecosystem and a mature cloud, but you rent the relationship and the brand sits in someone else's app. TTLock gives faster white label control at a lower cost per unit. Your own app costs real money and a team to maintain it.
Whichever you choose, settle five points in the contract before the first deposit and at every reorder: who owns the white label app and its store accounts; whether source code is escrowed; how many languages ship; who funds Alexa, Google and Apple Home certification; and what happens to user accounts if the app is retired.
Localisation is where private labels quietly break. Insist on the full interface, push notifications and error strings in every language you sell, and on your own app store developer accounts rather than the factory's. A lock sending error codes in the wrong language generates support calls for years.
Data Residency, Biometrics and Erasure
Ask where the data sits and get the answer in the contract, because GDPR follows the data, not the invoice. Require a named server region, a data processing agreement, and a documented deletion routine when an end user closes an account. A smart lock with strong privacy for room doors sells on exactly this point.
Biometric data is the sensitive part. Fingerprint and face templates should be stored on the device, encrypted and never uploaded, and the spec should say so. A fully automatic smart lock with face version that sends images to a foreign cloud can be unsellable in parts of Europe however well it works.
Ask one more question: can the lock run with no cloud at all? Local only mode, with Bluetooth credentials and no remote unlock, suits privacy sensitive buyers and sites where the internet is unreliable. It removes most of your compliance exposure.
Accounts, Permissions and Audit Trails
Project buyers care less about the app and more about who holds the administrator role. Require role based permissions, time limited guest codes, and an offline fallback when the internet drops, because a property manager will not accept a lock that fails with the router.
Then require an audit log with timestamps that an administrator can export, plus an open interface to the property management system. Ask whether the API is documented, versioned and survives a redesign. Integration that lives in one developer's head is a dependency you cannot sell.
- Firmware support period stated in years from last shipment
- End of service notice of at least twelve months
- Source code escrow for app and cloud components
- Data region and deletion routine named in the contract
- API documentation and PMS integration terms
- Biometric storage confirmed as on device only
When the Hardware Needs Software
Spare parts planning has a software side. If a mainboard fails in year three, the replacement must run the same firmware generation as the rest of the building, or a mixed fleet appears with different app behaviour. Ask whether old batches can still be upgraded. Even a simple unit such as a one grip fingerprint electronic door handle needs that answer.
Contract Clauses to Nail Down
Put six clauses into the manufacturing agreement, not an email thread nobody finds in year three: a named support window, an upgrade cadence, a breach notification deadline, liability for recall caused by software, escrow release conditions, and a defined end of life date for each model.
Then price it. Software support is not free, so budget a per unit annual fee and pass it through, or you fund year four yourself. A surcharge of one to two euro per lock per year is easier to defend than a 34 euro recall.
The Bottom Line
Private labelling a smart lock now means private labelling a software service. Get the support window, the exit notice, the data region and the escrow in writing before the first deposit, and treat the app as a product you are responsible for. Distributors who do this keep the account for the next project.