Security

Manufacturing systems sit close to physical equipment, so security is a design constraint rather than a feature. This page summarises how we think about protecting customer environments and how to report a problem.

Reporting a vulnerability

If you believe you have found a security issue in this website or in the FactoryNXT platform, please tell us before disclosing it publicly. Use the contact form and include enough detail to reproduce the issue. We will acknowledge your report and keep you updated while we investigate.

We ask that you avoid accessing or modifying data that is not yours, avoid degrading service for others, and give us reasonable time to remediate before publishing.

Platform architecture

• Edge collectors read from controllers over OPC UA, Ethernet/IP, and Modbus TCP without writing back to control logic.
• Deployments can run fully on-premise where plant policy prohibits outbound connectivity.
• Buffering at the edge means a network outage delays data rather than losing it.

Access control

Access is role-based, so an operator, a supervisor, and an administrator see different capabilities. Actions that change recipes or acknowledge alarms are attributable to an individual account.

Audit trails

Regulated customers require records that cannot be quietly altered. The platform records who did what and when, and retains that history for the period the customer configures.

This website

The marketing site is deliberately small, because the least exploitable code is the code that is not there. It serves static pages and exposes exactly one endpoint that accepts input: the demo request form.

• Request handling. Only GET and HEAD reach the page renderer; every other method is rejected on routes that do not expect a body.
• Form submissions. Every submission is size-capped, validated server-side rather than only in the browser, stripped of control characters before being written, and filtered through a hidden honeypot field that automated submissions tend to fill in.
• Enquiry storage. Submissions are written server-side and read through an internal dashboard that requires authentication, refuses to serve anything if no password is configured, compares credentials in constant time, and is excluded from search engines and from caching.
• Output handling. Enquiry text is rendered as text, never as markup, so a submission cannot inject script into the dashboard. CSV exports neutralise leading formula characters so an exported field cannot execute in a spreadsheet.
• No tracking. No analytics, advertising, session recording, or fingerprinting. See the Cookie Notice.

Data handling

What we collect through this site, how long we keep it, and how to have it removed is set out in full in our Privacy Policy.

Scope

This page describes the marketing site and the design principles of the FactoryNXT platform. Deployment-specific commitments — certifications, penetration test reports, hosting regions, uptime and incident response times — are covered in the customer agreement and supporting documentation, which we provide on request during evaluation.