How MrSanmiguel IOT Portal actually works

1. Sign up and pick a plan — your 14-day free trial starts right away and you get full access straight off, no card required at all.
2. Confirm your email with the link we send you — until you do, the account stays active but limited (see "Billing and plans" below).
3. Create your first Client and Group — this is how your clients stay separated from each other, each one only sees their own.
4. Add a Device — you download a package with its own certificate to load onto your ESP32 or whatever hardware you're using.
5. Set up automation rules, or just watch the data come in on your Grafana dashboard.

During the free trial you get exactly the same thing as a paid plan — nothing trimmed, no "upgrade to unlock."

Plans

The key numbers

What happens if something fails

If a charge fails, you get 7 days of grace with everything working exactly as before (we email you the moment it starts). If it's not resolved, the account moves to disabled: that's when your devices actually lose real access to the broker (not just a banner on screen) and the panel goes read-only — you can still see everything you had set up, but can't create or edit anything until you reactivate.

A disabled account is NOT deleted right away — you have 90 days to reactivate before everything is deleted for real (clients, groups, devices, certificates, dashboards). We email you before that happens.

If you cancel within the first 3 days of any charge, you're refunded automatically. If you cancel after those 3 days there's no refund, and you keep access until the end of the period you already paid for — the real cutoff only lands on the actual due date, not before.

Email confirmation

If your account is still on the trial (you haven't paid yet), you need to confirm your email before you can use the panel — same mechanism we use to invite Clients, so we avoid free trials with fake emails.

Every device gets its own client certificate (mTLS) when it's created — not a password shared across all of them. If a device gets compromised, you disable just that one, without touching the rest of your account.

All MQTT traffic is TLS-encrypted, and the broker requires the certificate on top of the username/password — both together, not either/or. The package you download when creating a device has everything it needs (certificate, key, CA certificate, credentials, broker host/port) — it's shown only once, save it like you would a password. If you lose it or suspect it's leaked, you don't need to delete and recreate the device from scratch (no, not that!): there's a button to regenerate credentials that instantly invalidates the old certificate and password and hands you a fresh package, with the same QR code as always.

Disabling a device revokes its real broker access instantly — it's not just a status change in the database.

Each device can only publish/listen on its own exact channel (client/group/device) — there's no way for one device to see or interfere with another's data, not even another group under the same client.

Rules engine

Checks all your active rules every 3 seconds. A rule is: source device + field + condition (greater/less/equal to a value) → command to a target device. Save the rule and it's live on the next cycle — nothing to "publish" or redeploy.

Each rule fires only once when the condition goes from false to true, and doesn't repeat while it stays true — this stops the same command being sent in a loop.

Don't want to build the rule by hand? Describe what you want in plain language and AI drafts the rule for you — review it before saving.

Device connectivity

A device is marked "disconnected" if it hasn't sent any data in the last 300 seconds. If a device disconnects (or comes back), you get an email letting you know — no need to be watching the screen to find out.

Dashboards

There are two different ways of looking at the same data, depending on who's looking:

You, as Admin: each of your Clients has its own isolated dashboard. You go in from your own panel to Grafana without having to log in again (SSO), and you only see your own Clients' dashboards — never another Admin's.

Your end Client: has their own username and password, and once they log in they can see the dashboard you set up for them, with no idea there's a whole platform behind it.

Raw data from each sensor is kept at full resolution for 90 days. After that, it's automatically summarised (averages) and stays queryable for 2 years — so long-term trends aren't lost, without you having to manage backups or storage.

The system doesn't ask you to configure any of this — it runs on its own, in the background, and it only shows up if something goes outside the normal range.

The numbers

Devices

There's no minimum time between sends — your device sends data as often as you need. What we do monitor is the rate: if a device goes over 600 messages in a 5-minute window (a pattern no normal sensor generates), it's disabled automatically and you get an email straight away explaining what happened and how to reactivate it if the traffic was legitimate. Each individual message also has an 8 KB cap, plenty for any normal telemetry reading.

It's a 3-strike system: the first time, you can reactivate it yourself from your panel. If the same device goes over the limit a second time, you can no longer reactivate it yourself — you'll need to contact us. The third time, it's completely blocked on the platform.

Automation rules

A rule can never fire its command more than once every 30 seconds, even if the condition triggering it is oscillating right at the threshold — this stops a noisy signal from ending up firing the same command in a loop at another device.

Invitations

You can invite up to 50 new Clients per day (creating an account or resending an invite both count together). Plenty for normal onboarding, even bulk; more than that and the system assumes something's wrong and stops.

Payments

If we detect real abuse on an account (not just a late payment), we can permanently block the card used and you won't be able to use it with us again.

Each of your Clients has their own Grafana organisation, fully isolated from everyone else's. You go in from your own panel without having to log in again (SSO); your end Client logs in with their own username and password and sees only the dashboard you set up for them.

Data arrives live from InfluxDB — nothing to export or sync by hand. You can build, edit and rearrange each Client's dashboards whenever you like; they only see what you decide to show them.

Data retention (90 days raw, 2 years aggregated) is the same as the rest of the platform — see "Data and retention" above.

A paid add-on ($35/mo per Admin, on top of any plan) for when the built-in rules engine isn't enough — chain any logic, call external APIs, build custom automations with no restrictions.

Each Admin who adds it gets their own dedicated container, fully isolated — not an environment shared with other Admins. You go in with no separate login screen (same session mechanism as the rest of the portal). For security, the editor doesn't allow running shell commands or installing arbitrary npm packages — the real isolation comes from the container and network, not Node-RED's own sandbox.

If you deactivate it, you have 15 days of grace before it's deleted for real. Visit the Pricing page to add it to your account.

My Account has a QR code — scan it with your phone's camera and it takes you straight to the PIN screen, skipping the email step entirely (the browser where you already have a session handles that part).

As soon as you're in, if your browser supports it, it offers to install the app: it becomes an icon on your home screen (or desktop, if you scanned from a computer running Chrome or Edge) and opens in its own window, no address bar or tabs — it looks and feels like a native app, even though it's the same site underneath. On iPhone, Apple gives no way to install apps automatically from the web — you'll see a banner with instructions instead (tap Share → Add to Home Screen).

At the same time, push notifications get turned on, so you hear about alerts (a device going offline, a rule firing) without needing the tab open. On iPhone this only works after installing the app — that's an Apple limitation, not the site's.

The QR expires after 15 minutes for security. If you took a while to scan it, there's a "Refresh QR" button right next to it that generates a fresh one instantly, no page reload needed.