Security design
Built to sit beside your control systems, never inside them.
This page describes how PHL AI is being designed to protect industrial data. These are design intentions: no control has been independently audited, and PHL AI holds no security certification today.
Status: design intent
No SOC 2, ISO/IEC 27001 or IEC 62443 certification or audit has been obtained. We will publish attestations only when they exist.
01Control boundary
Read-only, outbound-only.
A
Physical equipment
B
Edge connectivity
C
Data ingestion
D
Industrial data platform
E
Digital twins
F
Analytics & simulation
G
Application
Control boundary. Readings flow from the plant to PHL AI over outbound TLS. There is no write path back: PHL AI does not send commands to PLCs, setpoints or production controls. People act through the systems they already operate.
02Intended controls
How the design protects data.
Tenant isolation
Every record carries its workspace; database row-level security is enforced from the verified session; storage prefixes are scoped per workspace; cross-tenant access tests run in CI.
Authentication
Passwords hashed with Argon2id; TOTP multi-factor authentication required for Owners and Admins; secure, HTTP-only session cookies. SSO (SAML / OIDC) is planned.
Authorization
Deny by default. Every API action declares the permission it needs; objects are checked against the caller’s workspace.
Encryption
TLS 1.2+ in transit, including mutual TLS for gateways. Databases, object storage and backups encrypted at rest with managed keys (AWS KMS planned). Customer-managed keys are planned for Enterprise.
Secrets
Integration credentials stored in a secrets vault (AWS Secrets Manager planned) and never returned to the browser after saving.
Gateway security
One X.509 certificate per gateway, topic-scoped publish-only permissions, revocation and rotation from the console, read-only adapters.
Audit
Append-only log of sign-ins, role changes, rule and twin changes, alert actions, exports and integration changes, exportable by Admins.
Retention & deletion
Plan-based retention of raw readings and rollups; workspace deletion is soft for 30 days, then purged with an audit record.
Backup & recovery
Automated database backups with point-in-time recovery. Proposed targets: recovery point within 15 minutes, recovery time within 4 hours — targets, not tested results.
Monitoring & incidents
Alarms on ingestion lag, error rates and authentication anomalies; a written incident-response and customer-notification process before the first pilot.
03Roles
Five roles in the first release.
| Role | Can |
|---|---|
| Owner | Billing, workspace deletion, everything Admin can do |
| Admin | Users, roles, integrations, security settings, audit export |
| Engineer | Assets, twins, rules, scenarios, reports |
| Technician | Acknowledge, assign and resolve alerts; review notes |
| Viewer | Read-only |
04Readiness
Status of each capability.
| Capability | Design | Status |
|---|---|---|
| Organization-level access | Organizations contain workspaces; every record carries its workspace. | Available in MVP |
| Role-based permissions | Owner, Admin, Engineer, Technician, Viewer. | Available in MVP |
| Audit history | Append-only log of rule, twin, alert and access changes. | Available in MVP |
| Secure data handling | TLS in transit, encryption at rest, credentials in a secrets vault. | Available in MVP |
| Integration boundaries | Outbound-only gateways with per-device certificates and read-only adapters. | Requires adapter |
| Data retention controls | Plan-based retention of raw readings and rollups. | Available in MVP |
| Monitoring & recovery planning | Alarms on ingestion lag and errors; backup targets defined, not yet tested. | Planned |
| Single sign-on | SAML / OIDC. | Planned |
| Independent security attestation | No certification or audit has been obtained. | Not yet |
Bring your industrial systems into clearer view.
Start with a focused equipment workflow and expand toward connected digital twins and industrial simulation as your requirements evolve.
Illustrative demo · no signup · not connected to equipment