This platform holds credentials for equipment that keeps facilities alive and can issue commands to it. Every design decision below follows from that.
Every entity in the system, user, role, asset, location, alarm rule, escalation policy, API key, belongs to an account. Visibility is resolved by recursive traversal of the account tree inside the repository layer, so there is no application-level filter to forget, misconfigure or bypass.
Nesting depth is unlimited. A read scoped to Customer A returns Chicago and Dallas and nothing above or beside them.
Assets, locations, users, roles, alarm rules, escalation policies and API keys all carry an account. There is no global object a tenant can reach by accident.
Subtree visibility is computed by recursive query in the repository, which means the boundary holds for the API, the UI, an export and a background job identically.
Super-root operators administer every account without holding membership in any, and only they may upload protocol packs.
The selected account scope persists across every page, so an operator working a tenant incident is not repeatedly re-filtering the world.
Building, floor, room, row, rack and slot form a per-account tree; an asset's account is inherited from where it physically sits, not from who imported it.
| Default role | Grants |
|---|---|
| Admin | Full access within the account subtree, including users, roles and catalog |
| Operator | Asset and event management, command execution, simulator control |
| Viewer | Read-only across the account subtree |
Roles are definable per account with granular create, read, update and delete permissions per object type, asset, user, account, alarm, event, subscription, simulator and catalog. The defaults are a starting point, not the ceiling.
Device credentials are stored encrypted at rest. Redfish sessions are managed and refreshed by the platform; MQTT broker credentials are held encrypted per asset. Operators never need the device password to run a command.
Microsoft Entra ID, Google, GitHub or any compliant OIDC provider, alongside local credentials, no separate identity integration project.
Provisioned with an expiry and revocable individually, so automation inherits a person's scope and can be withdrawn without touching them.
Eight-hour session lifetime with secure cookie flags over TLS, and session activity written to the audit record.
Twenty failed attempts per IP and ten per user in a fifteen-minute window before lockout, counted centrally with graceful degradation if the counter store is unavailable.
Every write operation records a before and after diff, the actor, the timestamp and the source IP. Retention is indefinite, and there is a dedicated viewer in the admin interface rather than a log file someone has to be granted access to.
Each acknowledgement, shelve and clear is attributed and timestamped on the alarm record. "Who silenced this, when, and on what basis" is a question with an answer.
Control operations against devices are logged with the same fidelity as configuration changes, the difference between an incident review and an argument.
A bulletin library maintained at the platform tier matches automatically against assets by manufacturer and model, so an advisory arrives attached to the list of your equipment it affects rather than as a mail to interpret.
Telemetry retention is configurable and size-bounded, pruned in chunks with a row-level fallback at the boundary. Event retention is configurable independently. Audit history is kept regardless.
Rate limiting, IP policy, JWT validation and TLS termination in front of every northbound route.
Outbound webhooks are HMAC-signed; inbound Redfish event callbacks are validated the same way.
On-premises or your own cloud account. No mandatory vendor cloud, no telemetry egress requirement.
Structured JSON logs shipped to an aggregation stack with provisioned dashboards, so platform behavior is inspectable.
We are happy to walk your security team through the tenancy enforcement model, the credential storage design and the audit schema directly. That conversation tends to be shorter and more useful than a questionnaire.
The Purdue model, and the zones and conduits IEC 62443 builds on it, ask two questions of any platform that spans IT and OT: what level does each asset sit at, and what crosses between them. The platform answers both, and reports the answer rather than asking you to draw it.
Each asset carries a level, from Process through Basic control, Area supervisory, Site operations and Site business planning to the Enterprise network. The platform declares its own, Site operations by default. Level 3.5 is not a numbered level, so a DMZ is named as a zone, the way sites that run one already label it.
For six of the nine protocols the platform reaches out to the device, so the device accepts a connection and holds credentials rather than needing to find the platform. Redfish and SNMP run both ways; only MQTT requires the platform's address configured on the device. Each conduit records which.
One call returns every zone, the assets and protocols in it, and each connection classified as same level, adjacent or level-skipping, with transport and port. Level-skipping crossings and unclassified assets are counted separately, because those are the two things a review asks about first.
A level documents an asset; it never stops the platform polling one. A number typed into a form silently cutting telemetry from a chiller is a worse failure than the gap it closes, and an operator would have no way to see why. Enforcement belongs in an egress policy that says so out loud.
A security zone is a trust boundary, not a floor plan. Location stays Building, Room, Row and Rack; two devices in one rack can sit in different zones, and the platform keeps the two models apart.