Security & data sovereignty

What runs where. Who accesses what.
What gets logged.

For the IT and security leads who approve a platform for control software.

Book a technical callCRA knowledge center

Operations & data sovereignty

You decide where software and data live.

  • At the edge, even without a connection

    The control runs as a container on the device at the machine and keeps working when the network is down.

  • On your own infrastructure

    The runtime runs on your devices and servers; ORCHESTRATE can also be operated in your own environment, on OpenShift for example.

  • Cloud operation in Europe

    If you use logiccloud’s cloud operation, it is hosted in Europe.

  • Outbound through your proxy

    Edge devices respect the proxy setting of your corporate network (HTTPS_PROXY).

Devices

Every device identifies itself.

  • Onboarding with a one-time token

    A device is added to ORCHESTRATE with a token that is valid only once.

  • A certificate authority per tenant

    Every device receives a certificate from your tenant’s CA — renewable, revocable, with a warning 30 days before expiry.

  • What arrives is checked

    Rolled-out content is referenced by sha256 checksums; the device checks what it has loaded. Device requests are signed (HTTP Message Signatures, RFC 9421).

Users & permissions

Roles instead of master keys.

  • Fixed roles

    In ORCHESTRATE: admin, operator and viewer. Approving individual rollout stages is reserved for admins.

  • Single sign-on

    In ORCHESTRATE via OpenID Connect — with your company’s identity provider if you wish.

  • Access to project and HMI

    Only those a project is shared with can see it. In licensed cloud operation, only users with the role “View HMI” can operate an HMI.

Evidence

Every change traceable.

  • Immutable audit log

    Who changed what, and when — with IP address and changed fields, exportable as CSV.

  • Versioned builds

    Every build of a project is kept; every rolled-out application version is immutably indexed.

  • Separate tenants

    In ORCHESTRATE, customers and teams work strictly separated on one shared platform, each tenant with its own branding.

Frequently asked questions about security and data sovereignty

Does the control keep running if the cloud cannot be reached?

Yes, if it runs at the edge: the runtime works locally on the device. You need the cloud for engineering, rollouts and monitoring.

What may an AI agent do?

Through the agent-kit, an agent works with the same permissions as the user or API key it is connected with. A server can be started read-only; deleting requires the name as confirmation. That the agent shows a dry run and asks before every rollout is part of its instructions — batch approvals in ORCHESTRATE stay with admins in any case.

Is logiccloud CRA-compliant?

The platform provides the capabilities the Cyber Resilience Act calls for: updates for the support period, versioned builds, device and access management, and a log of every change. Conformity of the end product remains the manufacturer’s responsibility. More in the CRA knowledge center.