Security and IT, the way your team works
The plant connects outward and never accepts connections in. You sign in with the directory you already run. And you choose where the data lives, from shared cloud to a server in your own plant.
Where your data goes, hop by hop
Five steps from the machine to a person with a login. Each one does a single job.
- MachineSignals are read
Linesense reads the controller or a sensor. It never changes the machine's program.
- PlantEdge device buffers
Readings are stored on the device first, for hours to days if the link is down.
- Plant to LinesenseEncrypted, outbound
The device opens the connection itself, with its own credentials. No inbound firewall rule.
- Your choice of hostLinesense stores and computes
Shared cloud, dedicated cloud, your cloud account or a server in your plant.
- Your peopleUsers sign in
Through your single sign-on, with roles per site and line.
Configuration changes and signed updates reach the edge device over that same outbound connection, never through an open port.
Four ways to run Linesense
The same software in every option. What changes is who runs it and where the data sits.
Cloud
Shared platform, fastest to start.
- Who runs it
- We do
- Where data lives
- Our cloud, separated per customer. We tell you the region before you sign
- Updates
- Continuous, by us
- Internet
- Needed from the plant. The edge device buffers during outages
Dedicated cloud
An isolated instance only you use.
- Who runs it
- We do
- Where data lives
- Your own instance, in the region you choose. Encrypted with a key in your cloud account
- Updates
- By us, scheduled with you
- Internet
- Needed from the plant. Buffered during outages
Your cloud account
Runs inside your AWS or Azure account.
- Who runs it
- We operate it, under access you grant and can remove
- Where data lives
- In your account. It never leaves
- Updates
- By us, in your account
- Internet
- The plant needs a route to your cloud account
In your plant
A server inside your factory.
- Who runs it
- Your IT team, with our support
- Where data lives
- On your server, on your network
- Updates
- Signed bundles you apply in your own window. A backup is taken first, and a failed update rolls back
- Internet
- Not required, including fully air-gapped
Weak internet but you still want cloud dashboards? A hybrid setup keeps a Linesense node in the plant and syncs to the cloud whenever the link is up.
Identity and access
People sign in with accounts you already manage. When someone leaves your directory, they leave Linesense.
- Single sign-on
- Microsoft Entra ID, on-premises Active Directory over LDAP, and any SAML or OIDC provider
- Provisioning
- Users created and removed automatically with SCIM, on Enterprise
- Roles
- Viewer, operator, supervisor, maintenance and administrator roles, set per site and per line. Directory groups map to roles
- Audit trail
- Every configuration change, manual entry, edited downtime reason and role change is recorded with who and when, and can't be edited afterwards
Network and data
What your firewall team and your data owner will ask about.
The plant opens every connection. You make no inbound firewall rules and no port forwards.
Device traffic and every browser session use TLS.
Each edge device has its own identity and can only publish its own data. Revoke one device without touching the rest.
If the link or the power drops, readings wait on the device and are sent in order when it returns.
Export all your data at any time. Ask us to delete it and we do.
On dedicated cloud, data is encrypted with a key held in your cloud account. Revoke it and we lose access.
Connects to what you already run
Linesense reads from your machines and systems and adds loss analysis on top. It doesn't replace them.
Machines
- Controllers
- OPC-UA, Modbus TCP and RTU, Siemens S7 and EtherNet/IP
- No controller
- Sensors, stack lights, counters and reject outputs. Nothing in the machine is modified
Business systems
- SAP
- S/4HANA and ECC. Production orders and material master come in. Confirmations, scrap and maintenance notifications go out. Set up together with your SAP team
- Reporting
- Power BI and Excel, a REST API, and webhooks
SAP integration is on Enterprise. Power BI, the API and webhooks are on Professional and above.
How we operate
What we do with access to your system, in plain terms.
Least access
Our staff get the minimum access needed for the task in hand. On your cloud account or in your plant, that access is granted by you and removed by you.
Remote support you approve
We connect for support only when you approve it. Every session is logged, and you can switch remote support off entirely.
Signed updates
Software and edge device updates are cryptographically signed, so a server or device accepts only what came from us.
Backups for on-premises installs
On-premises systems ship with scheduled backups to storage you choose, and a backup is taken before every upgrade.
We answer your security questionnaire.
Send it to us before the demo or after. We answer in writing, and we say plainly where something isn't offered.
Questions IT teams ask
Do we have to open any inbound ports?
No. The edge device connects outward to Linesense over an encrypted connection. Nothing connects in from the internet to your plant network.
What happens if the internet goes down?
The edge device keeps recording and stores readings locally, for hours to days. When the link returns it sends them in order, so reports have no gaps.
Can it run with no internet at all?
Yes, on the in-plant option. The server runs on your network, and updates arrive as signed bundles that you apply yourself, including at air-gapped sites.
Do you hold ISO 27001 or SOC 2?
Not today. We won't imply otherwise. What we offer is a written answer to your own questionnaire, and deployment options where you hold the keys, the account or the server.
Who at Linesense can see our data?
Only staff working a task you have approved, with access that is logged. On dedicated cloud, revoking your encryption key cuts off our access. On your cloud account or in your plant, access is granted by you.
How do we leave, and what happens to our data?
Export everything at any time. If you ask us to delete your data, we delete it.
Bring your IT team to the demo
We walk through the data flow, the deployment options and your questionnaire, and say what suits your plant.