Collectors start every connection. The historian never stores a collector address to dial.
TwinEdge / Platform · Security & governancePlatform overview
Security and governance
The plant network stays closed. That is the design.
TwinEdge OS, collectors, and the historian are built for OT: SSH keys, no inbound hole, no internet required. TwinEdge Platform — in your rooms or in the cloud — gives each customer their own database. AI recommends. A person still approves.
Pick a layout. Same security rules.NO INBOUND TO OT
The plant stays closed. Collectors dial out.
TwinEdge OS, collectors, and a local historian sit on the OT network. The cloud never opens a hole back in. Each customer in the cloud has their own database.
OT network
SSH keys · default denyEdge server, collectors, and local historian next to the equipment
- Equipment / PLCRuns the plantNot in the loop
- CollectorsDial out on mTLSNo inbound
- TwinEdge OSEdge serverSSH key logon
- Local historianHistory on siteZero egress
Cloud
Own database per tenantApproved sync only. One customer cannot see another.
- TwinEdge PlatformCompare, learn, reportTLS in transit
- Tenant A databaseOnly A’s dataIsolated
- Tenant B databaseOnly B’s dataIsolated
- Tenant C databaseOnly C’s dataIsolated
Reading, history, and screens stay on TwinEdge OS if the cloud is unreachable.
Each tenant has their own database. One customer’s data cannot leak into another’s.
TwinEdge OS, collectors, and the historian are built for OT. TwinEdge Platform keeps each tenant in its own database, on-premise or in the cloud.
§ 01
What a security review is actually buying.
Managers need to know data cannot leak between customers. OT teams need to know the plant network does not have to be opened. Both are true at once, because the wiring enforces it.
- 01The plant network stays closed
Collectors start every connection. The historian never stores a collector address, so there is no inbound hole to justify, expire, or get wrong.
- 02Air-gapped is a normal layout
Install, certificates, and operation do not need the internet. A site with no outbound link keeps reading, storing, and alarming.
- 03Each customer has their own database
This is not a shared-schema SaaS with a tenant column. One customer cannot see another’s records, and support access is redacted.
- 04AI waits for a person
Recommendations are read-only first. A named person approves before work is handed to operations. The trail can be replayed later.
“If putting this on the network means opening a hole into OT, it does not belong in a plant.”
The dividing line
§ 02
How the network is drawn.
Collectors read the equipment and dial out. TwinEdge OS and the local historian sit on the plant network. The cloud, if you use it, never calls back in. TwinEdge is not in the control loop.
OT network topology. Same rules in every mode.PURDUE-STYLE ZONES
Level 4
Enterprise / cloud
TwinEdge Platform. Each tenant has their own database. Reports, fleet view, and models that one site cannot train alone.
Own DB per tenantTLSNo phone-home license
Level 3
Site operations / DMZ
Optional on-prem TwinEdge Platform or a historian replica. Still no inbound path into the plant network.
Customer hostedOutbound only
Level 2
Supervisory
TwinEdge OS and the local historian. SSH key logon. Own certificate authority. Screens and alarms stay here if the WAN drops.
SSH keysOwn CAZero egress
Level 1
Collectors
Read the signals and dial out. The historian never opens a connection toward a collector, so the firewall rule is one way.
mTLSDial outNo collector address stored
Level 0
Process
Equipment and PLCs run the plant. TwinEdge is not in the control loop and does not become the reason the plant stops.
Read onlyUnchanged
01 / TwinEdge OS
Hardened for the plant network
The edge server sits next to the equipment. Host logon is SSH keys only. Password login is off. The dashboard can be reached over an SSH tunnel. Default-deny firewall. Signed config. Works with no cloud.
- SSH key logon
- Password login off
- Default-deny inbound
- Air-gapped image
02 / Collectors and historian
One-way by design
Collectors always start the connection. The historian stores no collector address, issues its own certificates, and is proven with zero egress. Database ports stay unpublished. Support bundles never include tag values.
- Collectors dial out
- Mutual TLS
- Own CA · no internet
- Optional data diode
03 / Cloud and on-prem platform
No data leak by design
Each tenant has their own database, not a shared schema with a tenant_id column. The cloud half is never something a site depends on to keep running. Identity, roles, and audit travel with the data.
- Database per tenant
- No vendor phone-home
- Redacted support
- Your rooms or cloud
| Direction | What happens | Why it is safe |
|---|---|---|
| OT inbound | Nothing from TwinEdge | Collectors start every connection. There is no collector address to dial. |
| OT outbound | One port, mutual TLS, when you want a link | Same port for ingest and control. Optional. Air-gapped sites send nothing. |
| Host logon | SSH keys only | Password login is off. Dashboard access can ride an SSH tunnel. |
| Database ports | Not published | ClickHouse and PostgreSQL stay inside the product network. |
| Internet | Not required | No license phone-home, no public CA, no CDN, no remote fonts. |
§ 03
Air-gapped is the baseline, not a special case.
A historian that needs the internet for certificates, license checks, or updates is a historian you cannot put on an OT network. TwinEdge assumes no internet: not for install, not for certificates, not for support.
Collectors and a local historian sit with TwinEdge OS, so the site keeps history if the WAN is down — or if there is no WAN at all. Signed updates arrive on removable media. An optional data diode can take signed files in and send no protocol reply back.
No internet is a supported configuration, not a workaround. Install, license, certificates, and support do not require a route out. A canary on the same network must fail DNS and HTTP or the historian build fails.
| Control | What it means in the plant |
|---|---|
| Zero egress | Product containers have no route out. A canary that can reach DNS or HTTP fails the build. |
| Own certificate authority | No public CA, no ACME, no internet to issue collector certificates. |
| SSH key logon | Only the operator account can log on. Private keys never sit on the server image. |
| Data diode (optional) | Signed file capsules in. No acknowledgement, control command, or mounted receipt path back. |
| Offline updates | Release is signed, verified on read-only media, and installed with no registry pull. |
§ 04
Cloud with no data leak by design.
If TwinEdge Platform runs in the cloud, each customer still has their own database. That is the isolation boundary — not a row filter on a shared table. The site does not depend on the cloud to keep running.
- Own database
- Own keys and roles
- Own audit trail
- Own database
- Own keys and roles
- Own audit trail
- Own database
- Own keys and roles
- Own audit trail
No shared customer tables. One tenant cannot query another. Support bundles strip secrets and never carry tag values. There is no license check that phones home with plant data.
- 01One database per tenant
Customer records, telemetry context, and evidence live in that tenant’s database. There is no shared customer schema to mis-query.
- 02The cloud is not the plant
No alarm waits on it, no operator screen is served from it, and no reading is lost if it is unreachable for a week.
- 03Support cannot wander
Support bundles carry configuration with secrets stripped, and never tag values. Credentials are customer-owned references, not files in a ticket.
- 04Same rules in your rooms
Host TwinEdge Platform yourself and the tenant boundary, audit trail, and approval gates stay. Data does not have to leave your network.
§ 05
Who can log on, and what they can see.
People use your directory if you have one. Machines use certificates this product issued. The edge server is reached with SSH keys. Permissions are checked twice: on the action, then on the data.
- 01How people log on
Local accounts always. LDAP / Active Directory and optional OIDC when you want them. There is no default administrator password.
- 02How machines log on
Collectors enrol once, then use a client certificate from the product’s own CA. No public CA and no ACME. Certificate expiry is watched on the box.
- 03How the edge server is reached
TwinEdge OS host logon is SSH keys only. Password login is off. The dashboard can be opened over an SSH tunnel from a trusted laptop.
- 04What they are allowed to do
Roles are checked on the action, then again on the asset, area, source, or tag. An export cannot be approved by the person who requested it.
| Audience | What they get |
|---|---|
| OT / plant security | No inbound rule, SSH keys, air-gap, collectors that only dial out. |
| IT / identity | Local accounts, AD / LDAP, optional OIDC. No default password. Sessions expire and can be revoked. |
| CISO / risk | Tenant isolation, redacted support, hash-chained audit, export separation of duties. |
| Operations managers | AI cannot silently write to the plant. A named person still signs the handoff. |
§ 06
Approval, evidence, and replay stay attached to the work.
Governance is not a separate review document. A recommendation is bounded to approved context, dry-run, and a person before it becomes work. Source evidence travels with the result.
- 01
Read only first
Recommendations explain. Physical writeback is off until you switch it on.
- 02
Dry-run
See the plan, the policy check, and what would change before anyone accepts it.
- 03
A person approves
Operational handoff needs a named approver. The requester cannot approve their own export.
- 04
Hash-chained audit
Who, what, when, and why are written in order. If the chain cannot be written, the system does not look healthy.
- 05
Replay
Source context, diffs, and the final output stay attached so an incident review can reconstruct the work.
Physical writeback is disabled by default. Plans, policy checks, and what will change are visible before anyone accepts. If the audit chain cannot be written, the historian stops declaring itself ready — it will not look healthy while its record is broken.
That trail is tamper-evident, not a magic lock: an administrator with database access can still delete rows. What they cannot do is delete them without it showing. The signed audit stream can ship the redacted record to a plant-owned receiver.
Walk the topology against your OT standard.
Bring the questionnaire, the zone diagram, and the first site. We will map TwinEdge OS, collectors, the historian, and TwinEdge Platform onto the network you actually have — air-gapped, hybrid, or cloud — without opening the plant.