How Aditum Data protects your plant data

Where is our data hosted?

In the EU: the application runs in Frankfurt and the platform database in the Netherlands.

What does the connector at the plant do?

It only reads, and it only sends data out over HTTPS on port 443. There is no inbound port and no VPN.

• The OPC UA, MQTT and Modbus connectors contain no code that writes to a control system.
• It runs as a Windows service under a low-privilege account, or as a Linux service under a non-login user, and can go through your company proxy.
• The OPC UA server's certificate is verified before reading.
• Each connector has its own key; Aditum stores only a hash of it.
• The design follows the zones-and-conduits principles of ISA/IEC 62443: one outbound-only conduit per site.

Is data encrypted?

Yes: in transit on every connection, and at rest for credentials and documents with Aditum's own keys on top of the providers' disk encryption.

• TLS on every public connection, and TLS with certificate checks between the application and its message queue.
• Connection passwords, tokens and keys are encrypted before they are stored. A dedicated workspace gets its own key, which decrypts only that workspace's secrets.
• Uploaded documents (P&IDs, datasheets, 3D models) are encrypted before they leave the application, with a separate AES-256-GCM key per file.
• Passwords are stored as bcrypt hashes.
• The keys are held by Aditum Data; the hosted service has no customer-managed key.

How is our data kept apart from other customers?

Every request runs as one workspace, and the platform refuses to read customer data without one: it never falls back to a shared default.

• Every query is limited to the caller's organisation and access rights.
• A sign-in is valid only for the workspace that issued it; an unknown address gets "not found".
• Background jobs set the workspace explicitly, one workspace at a time.
• Standard customers are separated logically in a shared environment. A dedicated environment with its own database and its own key is available on request.

Who can sign in, and what can they do?

Sign in with Microsoft Entra ID, Google or SAML 2.0 single sign-on, or a password with two-step sign-in; roles decide what each person may change.

• Directory groups map to roles, an organisation can require single sign-on, and only listed groups may sign in. The organisation's owners can't be locked out by a group change.
• SAML 2.0 works per organisation, with trust bound to email domains proven in DNS. SCIM 2.0 keeps users and groups in step with your identity provider.
• Password accounts can use an authenticator app for two-step sign-in, and admins can require it. Repeated wrong passwords get growing waits.
• Roles are owner, admin, editor and viewer, plus access groups per source, pipeline and dashboard. Viewers can't change anything.
• People can see their sign-in history and sign out everywhere.

What does the AI see?

By default only metadata: table structure, column statistics, tag names and units. Never data rows, unless your organisation opts in.

• The platform calculates every number; saved pipelines and dashboards run without AI.
• An admin can switch AI off for the organisation, or send all its AI requests to the organisation's own AWS Bedrock or Azure endpoint.
• AI runs on Anthropic; if it is unavailable, requests fall back to OpenAI under the same data rules unless your admin switches the fallback off. Both are US-based providers.
• Aditum Data does not train AI models on customer data. The providers' own API terms apply to what they keep.
• Every AI call is logged with task, model, tokens and outcome, without the prompt or answer text.

Can Aditum Data be used to reach into our network?

No. Connectors that call a web address from Aditum's servers, and alert webhooks, reach only public internet addresses.

• Every request and every redirect step is checked; a private or internal address is refused.
• Webhooks are https only, never follow redirects, and are signed with an HMAC-SHA256 signature so the receiver can check they came from Aditum.
• A system inside your plant network is read through the edge connector or the on-site reader instead.

Is there an audit log?

Yes: sign-ins, member changes, configuration changes, runs, sharing and exports are logged per organisation, in a hash chain that shows if an entry was changed or removed.

• Owners and admins see the whole log; members see their own entries.
• The log can be exported, or pushed to a SIEM (Splunk, Microsoft Sentinel or generic JSON).

Backups, retention and deletion

The production database is backed up every night, encrypted, and an automated drill restores the backup into a separate database and checks its contents.

• Retention periods are set per kind of data, and an organisation's data can be exported and deleted on request, with a deletion report.
• Your pipelines write into destinations you own, so those rows stay yours whatever happens to Aditum Data. Pipelines and dashboards can also be exported as plain Python.

How is the software built?

Every change goes through automated tests and an independent review before it is merged, and releases are deployed deliberately, not automatically.

• Servers install dependencies only from lock files with pinned hashes.
• A secret scan stops any credential from entering the code.
• The web app sends a strict content-security policy.
• Edge connector downloads are published with checksums.

What is not in place yet

SOC 2 or ISO/IEC 27001 certification is not yet in place, and no independent penetration test has been done yet.

• The design follows ISA/IEC 62443 principles, with a self-assessment; it is not certified.
• An independent penetration test is planned before the first production contract; its scope is written.
• Email addresses of password accounts are not verified yet. Single sign-on accounts come from your identity provider.
• SCIM is tested with Entra- and Okta-shaped requests, but not yet against a live Entra or Okta tenant.
• Edge connector binaries are checksum-verified but not code-signed.
• In the shared hosted database, a read-only SQL login can list other organisations' table and column names (never their rows). A dedicated environment closes this.