Industrial IoT security you can verify.

We hold a SOC 2 Type II report, which means an independent auditor examined our security controls operating over a period of time, not just their design on paper. The report is shared under NDA, which is standard practice for SOC 2, since the document describes the control environment in detail. Report access is included on the Professional and Enterprise plans, as listed in the plan comparison on the pricing page and in the plan availability table on this page. For a security review, the practical sequence is: use this page to confirm the platform covers your baseline requirements (encryption at rest and in transit, enforced MFA, role-based access control, and the outbound-only edge architecture), then request the report through your account contact once an NDA is in place, and give your auditors the full control detail. The controls described on this page, including session and credential handling, are covered by the report.

The edge agent is a Docker container running on hardware at the site, and it initiates outbound connections only, so no inbound firewall holes are opened into the OT VLAN. That is usually the first answer an OT security review needs: the platform does not create a new inbound path to the control network, and nothing at the site listens for connections from the internet. Beyond connectivity, the agent is built for the reality that industrial sites lose their WAN link: it collects and buffers data locally and evaluates alarm thresholds locally, so local views keep working and alarms keep firing during an outage, then everything syncs to the cloud when the link returns. Data moving from the edge to the cloud is encrypted with TLS 1.3 on every plan. For network architecture, the result is a single outbound flow to allow rather than a set of inbound rules to defend.

Yes. ControlCom Connect supports single sign-on via SAML and OIDC, so users can sign in through the identity provider your organization already runs. Single sign-on is included on the Enterprise plan; if your security review requires it, plan on that tier and confirm your identity provider with your account contact when scoping. The identity baseline does not depend on tier: every plan includes enforced multi-factor authentication, magic-link sign-in, and role-based access control with Administrator, Editor, and View roles. MFA is enforced in the browser and in the mobile apps, with verification codes delivered by email or SMS that expire after 15 minutes and trusted device records that expire after 30 days. Role scoping determines what each user can see and change, and alarm acknowledgements are recorded with user attribution and a timestamp. Organizations running a security review typically pair single sign-on with the audit logging and SOC 2 report access described on this page, which is the Enterprise plan profile.

The platform implements the controls 21 CFR Part 11 requires of an electronic record system: enforced multi-factor authentication so access to records is attributable to an individual, role-based access control to scope who can create and change records, tamper-evident audit logging on every user action and alarm event, time-stamped electronic signatures on acknowledgements, and AES-256 encryption at rest with TLS 1.3 in transit protecting the records themselves. Alarm acknowledgements carry user attribution and a timestamp, which is the record structure FDA-regulated facilities need for review. Compliance itself is a property of your validated process rather than of any software alone, which is why we support customer-led IQ/OQ/PQ validation packages: your quality team executes the qualification against your intended use, and the platform provides the documented controls the protocol tests. Regulated operators typically run that validation as part of the evaluation, alongside SOC 2 report review under NDA.

No. ControlCom Connect is a managed service hosted on Amazon Web Services, with cloud data stored on AWS infrastructure in the United States; there is no self-hosted build of the platform. What you host is the ControlCom Edge Server, a containerized application (Docker, Windows MSI, .deb, .rpm, or macOS pkg) that runs on your network beside the equipment and makes outbound connections only. It evaluates threshold alarms, runs triggers and edge Virtual Variables, and serves Edge HMI panels on the local network, so the site keeps operating if the internet link drops. Attach the optional local time-series store and unsent readings are buffered and forwarded when the link returns, with 30-day local retention by default. In practice this split gives security teams a clean boundary: equipment data is collected and acted on locally, on hardware you control, while configuration, user management, and multi-site rollups run in the hosted service.

Sign-in sessions are encrypted and expire on their own, so a workstation left unattended does not stay authenticated indefinitely. Multi-factor authentication is enforced on user accounts in both the browser and the mobile apps: verification codes are delivered via email or SMS and expire after 15 minutes, and trusted device records expire after 30 days, after which the device verifies again. Passwords are never stored in a readable form and cannot be retrieved by anyone at ControlCom, only reset by the account holder, which means a support conversation can never expose a credential. Role-based access control determines what an authenticated session can actually do, with Administrator, Editor, and View roles scoping each user, and actions such as alarm acknowledgements are recorded with user attribution and a timestamp in the audit trail. The SOC 2 Type II report, shared under NDA on qualifying plans, covers the implementation behind these controls.