For your IT department
What leaves your plant. And what does not.
We document which data is transmitted, over which port, in which direction and where it is stored. Your IT can then decide in ten minutes instead of asking questions for two weeks.
Data scope
Your know-how stays in-house.
The edge box reads condition variables, not production content. What makes up your competitive advantage, it never sees.
Stays with you
- NC programs and tool offsets
- Drawings, CAD and CAM data
- Workpiece geometry and part dimensions
- Order, customer and costing data
- Operator and shift data
- Raw vibration signals
Transmitted encrypted
- Calculated vibration features of the spindle
- Speed and load values from the CNC control
- Machine status and CNC control alarms
- Timestamps and machine identifier
The box calculates the features on site and transmits only the result. No production content can be reconstructed from these values.
Protection against intervention
Read-only. Four independent safeguards.
The most common question from maintenance teams is: can the device change settings on my machine? No. Four mutually independent safeguards make sure of that.
- ANo write functionThe software contains no code that writes to a CNC control. What does not exist cannot be triggered.
- BUpstream blockA dedicated protective layer blocks any request that would change something before it reaches the CNC control.
- CAutomated checksWith every change to the software, automated tests verify that no write path has been introduced.
- DRead-only user on the CNC controlA dedicated user with read rights only, for SINUMERIK for example only
SinuReadAllandAlarmRead.
Network
Three rules for your firewall.
Nothing more is needed. The box cannot be reached from outside; it accepts no inbound connections.
| Direction | Destination | Port | Purpose |
|---|---|---|---|
| Box → CNC control | IP of the CNC control | 4840 · OPC UA | Read only |
| Box → platform | Provided at project start | 8883 · MQTT/TLS otherwise 443 | Send features |
| Box → update server | Provided at project start | 443 · HTTPS | Fetch signed updates |
| Outside → box | – | none | No connection possible |
If your firewall uses TLS inspection, the box needs an exception. Otherwise mutual certificate validation fails and nothing is transmitted. That is intentional: the box really does validate certificates.
Encryption and operation
No segment runs in plain text.
- CNC control → box
- OPC UA, signed and encryptedSecurity policy Basic256Sha256. Certificates are explicitly trusted by both sides.
- Box → platform
- TLS 1.2 or higherEvery box has its own certificate. The private key is generated on the box and never leaves it.
- Polling rate
- Once per secondTechnically limited to at most once every 0.1 s so that the CNC control is not loaded.
- Network outage
- At least 7 days of bufferThe box stores data locally and sends it on without gaps as soon as the connection is restored.
Data stored in Germany
Processing and storage exclusively in data centres in Germany.
Signed updates
The box only installs software updates with a valid digital signature.
Your data belongs to you
You can export your data at any time. When the contract ends, we delete it verifiably.
Security datasheet
Put us in touch with your IT team.
We go through the security datasheet with your IT lead in 20 minutes, technically and without a sales pitch. You receive the document in advance as a PDF.
Request a technical call →IT security sheet as PDF (2 pages)