For your IT team

The architecture, without the sales layer.

Somebody is going to ask you whether this is any good. This page is written for you: what lands on your network, what it talks to, what it needs opening, who can see what, and what you are left holding at the end of the install.

SmartFactory is built by a systems integrator. We have spent seventeen years on the other side of this conversation, in plant rooms and switch cupboards, and we know what an unsupportable install looks like. The goal here is not to work around your IT function. It is to hand it a clean, documented estate and get out of the way.

Talk to an engineer Machine connectivity and API detail

Deployment

One outbound connection. Nothing inbound.

SmartFactory runs as multi-tenant cloud software. Where it needs to reach devices on your plant network, a site gateway does it — a Windows service or a Linux container on a box you already have.

  • The gateway opens one persistent outbound connection over TLS on TCP 443 and keeps it open. That is the whole network requirement.
  • No inbound rule. No port forward. No VPN. No static IP. No DMZ host. Nothing on your side listens for the internet.
  • The only local listener is an optional status endpoint bound to loopback, and it can be switched off with a config value.
  • The connect credential travels in a request header, never in a query string, because a gateway reconnecting overnight would otherwise scatter its key through your log rotation.
  • Reconnection backs off to a one-minute interval and then keeps trying indefinitely. The stock behaviour for a web client gives up after four attempts, which is right for a browser tab and wrong for a service in a cupboard.
  • If SmartFactory runs on the same LAN as the plant, there is no gateway at all — the same capture code runs in the on-premises host and talks to devices directly. Direct-connect is a first-class deployment, not a fallback.

Outages

The line drops. The factory does not.

  • Readings queue to a local database file on the gateway and drain in order when the link returns. The buffer holds tens of thousands of batches and survives a reboot.
  • Telemetry is buffered. Liveness is not. A gateway back from an hour offline does not replay an hour of stale heartbeats — health reporting is deliberately dropped rather than queued, so nothing reports a machine as up at a time in the past.
  • A batch leaves the queue on an acknowledgement and on nothing else. A duplicate acknowledgement counts, because one lost reply must not wedge the queue forever. A send that throws does not count.
  • Batches carry idempotency keys, so a replay after a partial failure cannot double-count production.
  • You can watch this happen. Pull the internet, keep producing, watch the queue depth climb, plug it back in and watch it drain. It is the demo worth asking us for.

On your network

What actually lands on your estate.

All of it is off-the-shelf. None of it is ours to sell you at a markup, and none of it locks you in.

  • Energy metering is Modbus TCP over your existing network, with split-core CTs clamped on. No rewiring, no downtime to install, and your electrician can fit them.
  • Cycle counting is a volt-free contact or a clip-on power clamp. Where a machine must never lose a count, our DIN-rail node counts in hardware and buffers locally.
  • Machine data over OPC UA is read-only. Write support is not a setting we have turned off — it is not in the product. We do not push anything to a PLC or a machine controller.
  • Server certificates are validated. Untrusted certificates are rejected unless you explicitly configure that connection to accept one.
  • We do write to two kinds of device: printers, when printing, and smart relays, when provisioning them with their own credentials. Nothing else on your network is written to.
  • Every device gets its own credentials, minted per device, and is bound to its own message namespace — a device cannot read another device’s data or publish as one.
  • Installation is one installer and a single-use enrolment code that expires in fifteen minutes. The gateway exchanges it for a key, stores that key protected by the platform key store, and forgets the code. It supports silent install for a managed rollout.
  • Devices are configured from the cloud through the same connection. Adding a meter does not mean a site visit or a laptop in a switch cupboard.
  • A per-site health page shows broker, meters, OPC UA sessions, printers and door events as separate chips with counts and last-seen times, so “is the site up” has an answer that is not a phone call.

If the estate is not there to land on

All of the above assumes a port near the machine, coverage at the far press and somewhere sensible for the gateway to live. Where that does not exist yet, the same company designs and installs it — structured cabling, fibre, shop-floor wireless, racks and comms rooms. Your own contractors are equally welcome to do the work; none of it is a condition of running SmartFactory.

Infrastructure services

Tenancy & access

Who can see what, and how it is enforced.

  • Your data is in its own tenant. The isolation is a filter applied at the data-access layer to every query in the system, so an endpoint cannot forget it.
  • Access is two independent locks that compose: the role a user holds, and whether the module is enabled at all. Both have to pass. Automated route sweeps assert that every route carries both — and when a sweep fails, the route policy gets fixed, never the sweep.
  • Shop-floor stations log in with an operator code and a PIN. PINs are hashed, weak ones are refused, repeated failures lock out, and a wrong PIN and an unknown operator return the same message. A station token is not a user account and carries no user identity.
  • Microsoft 365 single sign-on for office users, with roles from operator through to director.
  • Andon TVs are paired with a scoped, read-only display token that is revocable and delivered so it never lands in a log. A corridor screen never carries a person’s login — an unattended session with a human’s write rights is worse than a scoped token, not better.
  • A display token, an API key and a gateway key are three different credentials on three different surfaces, and presenting one where another is expected is refused. That is asserted by test in both directions.

Integration

Documented, versioned and demonstrable.

  • A public OpenAPI document served from the API itself, with documentation pages that ship as part of the application — no CDN script, because the production content-security policy does not allow one.
  • Scoped API keys: read production data, read energy, write jobs, manage webhooks. A key carries no role claims at all, so it cannot satisfy an admin policy even by accident.
  • Keys are shown once, stored hashed, compared in constant time and revoked immediately — no cache to wait out.
  • Rate limits are published in the response headers on every call, and a 429 carries a Retry-After. You should not have to discover a rate limit in production.
  • Webhooks are HMAC-signed with a timestamped signature header, deliberately the same construction as Stripe’s, so your integrator has already written this code. The documented timestamp tolerance lets you reject replays.
  • Delivery retries follow a published eight-attempt ladder spanning roughly nine hours, with jitter so every tenant’s backlog does not arrive at your endpoint in the same second. A 4xx that will never succeed dead-letters immediately rather than retrying for a day.
  • Outbound webhook targets must be HTTPS, are re-resolved at send time rather than only at save time, and redirects are not followed — a 302 to a cloud metadata address would otherwise defeat the checks.
  • Events are written in the same database transaction as the change they describe, so there is no window in which the event exists and the change does not.
  • Works orders arrive by spreadsheet import with preview before commit, or one at a time over the API. Either way, nothing is guessed and nothing already started is modified.
  • For stock, you choose which system is authoritative: SmartFactory, your ERP fed by these webhooks, or the value landed in QuickBooks Online. In ERP-authoritative mode the write paths that belong to your ERP are refused here, with the reason on screen.

Handover

Every install ends with a documented estate.

This is the part that decides whether you resent this system in two years. We are not trying to become a dependency.

  • You get the device inventory: what was fitted, where, with serial numbers, firmware versions and addresses.
  • You get the network notes: addresses, VLANs, what talks to what, and which ports matter.
  • Credentials go into your vault, not ours. Every credential we issue is revocable and rotatable from the UI by your admins, without us.
  • You get runbooks for the things that break: a gateway that will not connect, a printer that stopped, a meter that dropped off.
  • Much of the inventory maintains itself, because it is the live system rather than a document. Printers report their own make, model and serial; a serial change at a known address is flagged rather than silently printed to. Gateways report version, OS and last-seen. The register does not go stale between audits.
  • Built to be supportable by your team, not dependent on ours. If you want us on the end of a phone anyway, we are — but that should be your choice, not the architecture’s.

Security practices

The short version, for your questionnaire.

Transport

HTTPS everywhere. The site gateway makes one outbound TLS connection on 443. Nothing on your network listens for the internet.

Tenancy

Your data sits in its own tenant. Isolation is enforced at the data-access layer on every query, not by a filter each endpoint has to remember.

Credentials

Machine credentials are encrypted at rest. API keys and display tokens are hashed, shown once, and revocable immediately. There is no shared default password to hand over.

Least privilege

An API key carries no role. A display token is read-only and scoped to one board. A station token is not a user account. None of them can be swapped for another.

Operations

UK company, UK-operated cloud, UK support desk. The people who answer a security questionnaire are the people who wrote the code.

What we do not claim

We hold no security certifications. We would rather tell you exactly how it works and answer your questionnaire than point at a badge.

If your process needs a completed security questionnaire, send it over. An engineer will answer it, not a form.

Send us the awkward questions.

Bring the ones that usually end a cloud MES conversation — inbound rules, data ownership, what happens when the line drops, what we leave behind. We would rather answer them now than in month three.

Book a demo Start a free trial