You are the person who has to sign this off, so here is the short version: no inbound port, no VPN concentrator, no jump host, and no agent phoning home on its own schedule. The plant calls out over HTTPS, the same direction as Windows Update. Fully air-gapped is a supported configuration, not a workaround.
Every row here is an architectural property, not a configuration option you have to remember to set. If any of it is wrong for your environment, it is better that you find out on this page than three weeks into a pilot.
| Question | Answer | How |
|---|---|---|
| Does it need an inbound firewall rule? | No | Every connection originates inside the plant. The fleet manager queues work; the plant collects it on its next call out. Nothing listens for the outside world. |
| Does it need a VPN or a site-to-site tunnel? | No | Outbound HTTPS on 443. No concentrator to licence, no per-site tunnel to maintain. |
| Can it run with no internet at all? | Yes | Reading machines, processing, rules, alerts and local storage are all on-node. Air-gapped is a supported deployment. Nothing degrades when the link drops; data queues encrypted and backfills into the correct time window on recovery. |
| Is traffic authenticated both ways? | Yes | Mutual TLS on every connection; device identity is a certificate, not a shared secret. Custom CA and IP-based SANs are supported for private networks. |
| Does it touch the control layer? | No | Read-only by default, over the protocols your equipment already speaks. Writing a setpoint is an explicit, separately-permissioned action. It is recorded, it is reversible, and it never happens as a side effect. |
| Does any data leave without us deciding? | No | You configure what publishes and where. Self-hosted, nothing leaves. There is no vendor telemetry channel and no licence check that calls home. |
| Do we have to replace SCADA / PLCs? | No | It reads alongside what you run today. Operators keep the same screens; the control programs are untouched. |
| Can we see who changed what? | Yes | Every state change is written to a tamper-evident record: actor, target, time, reason. Export it whole for an audit. Four roles with field-level permissions. |
Linux only, two container runtimes, pinned base images. The support matrix is deliberately narrow so that what we test is what you run.
The DMZ bridge polls the fleet manager on a schedule over HTTPS. Work is pulled in, never pushed. A proxy in the path is fine.
When you need live troubleshooting, you open a secure session on demand. It is not a standing channel.
Mutual TLS end to end. A node proves what it is with a certificate you issued; a stolen token is not enough to join the fleet.
Supports your own CA, and IP SANs for networks with no DNS.
On the plant floor, in your private cloud or VPC, or hosted by us. The same product in all three. The readings and the audit record stay wherever you put them.
Retention is configurable per tier, not fixed by a licence.
Local buffering through drops and power cuts. Missing windows backfill into their correct slot, so a daily roll-up has no holes to explain.
Four roles (viewer, operator, engineer, admin) with field-level permissions, enforced on the server rather than hidden in the UI.
Config changes are versioned; drift against the intended state is detected and reported.
The audit record is a hash chain, so tampering is detectable rather than merely discouraged. Export it whole for GMP, ISO, or CCTS work.
Readings are published to a Unified Namespace: one live MQTT tree shaped by the ISA-95 hierarchy. The path is the routing, which is why a new consumer can subscribe without any producer changing. This is the technical form of what the rest of the site calls "one vocabulary".
uns/gurugram/area-a/line-1/plc-01/temperature
On top of that naming sits a contextualised knowledge graph — the same site/line/device hierarchy, carrying what each node measures and what it costs, queryable over MCP by your own agents. Any consumer subscribes by topic pattern, including wildcards: a processing flow, the rules engine, a historian, a BI tool, an AI assistant. Add a consumer without touching a producer; that is the whole point. Published standards throughout. ISA-95 for the hierarchy, MQTT for transport, OPC-UA and friends at the equipment edge. Nothing proprietary, and no file format only we can read.
New protocols ship as installable blocks against a stable contract, not as a platform upgrade. If something on your critical path is missing, that is a conversation, not a rewrite.
New protocols ship as installable blocks against a stable contract — if the one on your critical path isn't listed, that is a delivery conversation rather than a platform rewrite. Already running a historian? Keep it. EdgeBits publishes into AVEVA PI and reaches Ignition through Sparkplug B, so this sits alongside your estate rather than asking you to replace it.
Bare-metal Linux, Docker, or Kubernetes. A one-time claim code registers the node outbound; there is no inbound enrolment step and no IT escalation per site.
$ curl -fsSL https://get.edgebits.io | sh
$ edgebits onboard --claim EBX-4F7A-9K2M
✓ Registered as edge-gurugram-01
$ docker run -d --name edgebits \
-e CLAIM_CODE=EBX-4F7A-9K2M \
-v /data/edgebits:/data \
edgebits/edge:latest
$ helm repo add edgebits https://charts.edgebits.io
$ helm install edge edgebits/edge \
--set claimCode=EBX-4F7A-9K2M
Native .deb and .rpm packages are published for arm64 and amd64, so an air-gapped site can install from a mirror you control, with no container registry in the path. Host OS matrix: Raspberry Pi OS Bookworm 64-bit, Ubuntu 24.04 LTS, Rocky Linux / AlmaLinux 9.4.
If you have a standard security review pack, send it over. We would rather answer it up front than discover a blocker after a pilot is underway. A 30-minute call with an engineer, not a sales pass.