Plant data ends up in board presentations and courtrooms. The plumbing deserves the same care as the product.
| Transport | TLS 1.3 between collectors and core; mutual TLS option for edge bundles |
| Access | Role model per plant, per line and per tag class; SSO via OIDC |
| Audit | Every schema change and data export is signed and retained for 24 months |
| Data residency | EU regions only; edge bundles can run fully offline |
| Secrets | Store-and-forward buffers encrypted at rest (AES-256) |
| Response | Critical reports answered within 24 h; coordinated disclosure honored |
Reports and questions: security@ostwerk-io.example.com. We acknowledge within one business day.