IoT platforms: registry, messaging, rules, storage and dashboards
In short: An IoT platform is the software that sits between devices and applications. It registers and authenticates devices, ingests their messages, routes data through rules, stores it and presents it in dashboards, while also managing configuration and updates. You can use a managed cloud service or self-host open-source components.
What a platform is for
Without a platform, every IoT project would rebuild the same plumbing: a way to know which devices exist, accept their data securely, store it, react to it and update them. An IoT platform provides these services so you can focus on your actual application. All major cloud providers offer one, and there are many open-source and specialist options.
Core services
| Service | What it does | Security point |
|---|---|---|
| Device registry | Lists each device, its identity, metadata and status | Only registered devices may connect; revoke lost ones |
| Messaging / ingestion | Accepts telemetry, usually via MQTT or HTTPS, and sends commands back | TLS, per-device credentials, topic-level authorisation |
| Rules engine | Filters, transforms and routes messages; triggers alerts | Validate input; limit what rules can call |
| Storage | Time-series database for readings, object storage for files | Encryption at rest, least-privilege access |
| Dashboards and APIs | Show data to people and other systems | MFA for users, scoped API keys |
| Device management | Configuration, remote commands, over-the-air updates | Signed updates, audit logging |
Many platforms also keep a device shadow or twin: a stored copy of each device's last reported and desired state, so applications can read or change settings even when the device is asleep.
Managed or self-hosted?
A managed service suits teams who want to move fast and scale without running servers. A self-hosted stack, for example an open-source MQTT broker, a time-series database and a dashboard tool on your own servers, suits those who need full control, must keep data on premises or want to avoid usage charges. Hybrid designs are common: a local platform at each site, with summaries sent to the cloud.
Choosing and securing a platform
- List your needs: device count, message rate, protocols, data retention and where data must live.
- Check how devices authenticate. Prefer per-device X.509 certificates over shared keys.
- Check authorisation: can each device publish only to its own topics?
- Confirm encryption in transit and at rest, and who controls the keys.
- Look at export options so you are not locked in.
- Enable audit logging and integrate it with your security monitoring.
Tip: under the cloud shared responsibility model, the provider secures the platform service, but you are still responsible for device identities, access policies, data classification and your own applications.
Practice
What is a device registry?
What is a device shadow (or twin) used for?
Give one reason to self-host an IoT platform.
Key takeaways
- An IoT platform provides registry, messaging, rules, storage, dashboards and device management.
- Device shadows hold reported and desired state for sleeping devices.
- Managed platforms are quick to scale; self-hosted gives full control.
- Prefer per-device certificates and topic-level authorisation.
- You still own device identities and access policies in the cloud.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.