There is a tunnel created between Phone and Gateway, in which data is encrypted with a key determined during the provisioning process – requiring physical access to the device (gateway).  
Once a key is generated, it remains in possession of the user only, and the lock for this key is only in the gateway module. As a result, the control or measurement data which passes through the system remain encrypted for the operator (Linkk), who is not able to decode them or control any of the user’s devices without their knowledge. To better explain how the system works, one can use an analogy: the system has a door map, and it knows which key fits which door without physically having any key to open it. The user has a key and a map, which allows him to open the door to which he had previously acquired the key.