The installer's access should end when the job does

A connected heat pump reports a great deal about a home: when the family is in, how warm they keep it, how long the system runs, when a door is left open in January. My position is that none of this should be visible by default to the contractor who installed the equipment, for as long as the equipment lasts. Access to a household's system data should be granted by the household, for a job or for a service relationship it names, and should end when the household decides or the house changes hands. Manufacturers should hold themselves to a published list of purposes, and utilities should reach a home only through the homeowner's own enrolment.

This is not a complaint about contractors. The installers I know use system data to fix problems faster and to spot failing components before a family loses heat. The trouble lies in a default that most of our industry, including my own company, adopted without much thought: the installing dealer is linked to the system at commissioning and stays linked indefinitely.

How a service login outlived the service

I first met the question in 2014 at Quenby Controls, where I led connected products. A utility customer asked for runtime data from every Quenby thermostat in its territory to plan a demand-response programme. The data would have been useful, and the contract was valuable. I argued that we should provide it only for homeowners who enrolled, and we lost part of the contract. I made that argument then mostly on instinct. I can make it better now, because I have since seen what happens when a sensible-looking default runs for a decade.

When Ambersley launched its communicating control in 2018, we linked each system to the dealer who commissioned it. That dealer received fault alerts and could see operating history for the life of the system. In 2022 we checked how that was working. Of our connected systems at the time, about 41,000 were linked to a dealer who had not visited the home in more than two years. Many of those homes had been sold. New owners were receiving telephone calls from contractors they had never hired, who knew their system had logged a fault. Some contractors had sold their businesses, and the access had passed with the customer list.

Nobody had designed that outcome. It followed from treating installation as the start of a permanent relationship, when for most households it is a transaction followed by occasional service from whoever answers the telephone.

Access that follows the household

We changed the model in 2023. A homeowner now creates an account when the system is commissioned, or later, and decides who can see it. A contractor receives access for a specific job, which expires after ninety days, or the homeowner can name a contractor as an ongoing service provider, which lasts until the homeowner removes them. When a house is sold, the new owner claims the system and every previous link ends. Contractors can see which homes have granted them access, and homeowners can see every party with access, including Ambersley's own service staff.

The first version had a flaw. We introduced the ongoing-provider option several months after the ninety-day expiry, and in between, homeowners with maintenance agreements found their contractor locked out between visits. They were right to be annoyed, and I should have launched both together. The general point survives the mistake: the default should be that access ends, and the household should be the one to extend it.

Dealers lost something real. Fault alerts from homes they had installed years earlier had produced service calls and maintenance agreements. Several dealers on our advisory council estimated that the change cost them a meaningful share of their service leads. I accepted that cost because the leads depended on data the homeowner had never knowingly shared. A contractor who does good work can still ask a customer to name them as the ongoing provider, and most of the dealers who asked were named. The ones who lost the most were those whose service business rested on alerts from homes where nobody remembered hiring them.

The manufacturer is not exempt. We use fleet data for engineering analysis, warranty decisions and safety monitoring, and we publish that list of purposes. We do not sell data about individual homes. In 2022 we declined an offer from a data buyer worth about US$4.2 million a year for aggregated household data at a level of detail that could, combined with property records, have identified individual homes. When our safety team needed heat-kit temperature data after a recall, we added safety monitoring to the published purposes and told every connected household before we started.

What a utility may ask a thermostat to do

Utilities have good reasons to want connected heating and cooling. A fleet of heat pumps that can shift its demand by an hour on a hot afternoon is cheaper than a new peaking plant. I support demand-response programmes and Ambersley takes part in them. The question is who agrees, and to what.

Our rule is that a utility reaches a household only through that household's own enrolment, on terms the homeowner can see before agreeing. The control shows the limits of each programme: how far the temperature may be moved, how many events a month and for how long. The homeowner can override any event from the thermostat or the app without penalty from us. We receive a fee from utilities for each enrolled home, and we disclose that in the enrolment screen, because a household should know when the manufacturer benefits from its participation.

Some utilities would prefer automatic enrolment with an opt-out, which produces larger programmes. I understand the appeal and still disagree. Heating is not a service a household can easily do without, and a family that wakes up cold because of an event it never agreed to will turn the feature off, distrust the equipment and tell its neighbours.

None of this requires new law, though I would welcome clearer federal rules on connected-device data. It requires manufacturers to decide, before the next platform launches, who the system answers to. My answer is the people living with it. Every other party, including the manufacturer, should have to show the household why it is there.