PSS has been through supplier security assessments at some of the most demanding manufacturers in North America. The Trust Center lists ISO 27001, SOC 2, and IEC 62443 coverage for remote support and analytics, with a link to every source certificate.
How does remote support work without a VPN? ARCHITECTURE
An enterprise RMM agent on the PSS panel initiates an outbound, TLS-encrypted connection to the RMM cloud. Our expert authenticates with 2FA under role-based access and the cloud brokers an end-to-end encrypted session to that specific panel only. There is no VPN tunnel, no inbound firewall rule, and no routable path into your network at any time.
What firewall changes do we need to make? NETWORK
For remote support: outbound TCP 443 (TCP 7075 fallback) and port 80 for agent updates — no inbound ports. For analytics: the Edge Gateway makes outbound-only encrypted MQTT + HTTPS(443) connections; no inbound ports and typically no firewall modifications at all.
What data do you collect? Any PII or images? DATA
Analytics collects booleans, numeric process values, strings (part numbers, batch codes, operator IDs) and timestamps. No image data, no user credentials, no personally identifiable information. Camera footage is stored on a local NVR and never leaves site without local access first.
Who owns our production data? DATA
You do. Permission to share your data is never assumed under any circumstance, and we will amend the NDA to state so explicitly if yours doesn't already cover it.
Is data encrypted in transit and at rest? ENCRYPTION
Yes — AES-256 encryption with TLS for all transmissions, and encrypted storage end-to-end in line with ISO certification requirements. A certificate-authority system protects against man-in-the-middle attacks.
Where is our data stored? CLOUD
In ISO 27001-certified data centers — European facilities for GDPR compliance, with SOC 2-certified US options available (New York and San Francisco). Cloud servers operate in an internal mesh; replication traffic never traverses the public internet.
How long is data retained? DATA
Retention is configurable at device setup to match your policy, with up to 5 years of part-level traceability and quality history available.
How is access controlled and revoked? ACCESS
Multi-factor authentication is enforced for all users, with role-based access control under a principle-of-least-privilege methodology. A designated admin can revoke any account instantly from the admin console. Every session is logged in a comprehensive audit trail.
Can our people see what your technicians are doing? TRANSPARENCY
Yes — a lineside monitor displays support activity in real time during every session, and sessions can be recorded for training. Optionally, we can require one of your representatives at the cell to physically approve each remote session before it starts.
How is the panel itself protected? ENDPOINT
Windows 11 IoT LTSC with enterprise-grade Endpoint Detection & Response, 24/7 remote monitoring with real-time threat detection, automated patch management, and rogue-software oversight that blocks unauthorized installations. Hardware is industrial-grade with IP-rated enclosures and port blockers.
What do we need to provide? SETUP
One internet drop VLAN'd off your core network with outbound 443 open, physical space for the panel, and an IT contact for validation. Professional installation, network configuration, security validation, and training are handled by our certified technicians.
We already have a production management system. Why this? ANALYTICS
PSS works a layer deeper: micro-cycle machine rhythm, PLC step-to-fault timing, SPC on raw sensor data, and 5-year part traceability — diagnostics your MES/ERP never sees. API access lets it feed your existing systems rather than replace them.
