---
title: "Platform security and data sovereignty | logiccloud"
description: "Where the control runs, how devices and users identify themselves, who approves what and what is logged: security and data sovereignty at logiccloud."
url: https://logiccloud.com/en/security/
language: en-GB
---

Security & data sovereignty

What runs where. Who accesses what.\
What gets logged.
=================

For the IT and security leads who approve a platform for control software.

[Book a technical call](https://logiccloud.com/en/contact/) [CRA knowledge center](https://logiccloud.com/en/cra/)

Operations & data sovereignty

## You decide where software and data live.

- ### At the edge, even without a connection

  The control runs as a container on the device at the machine and keeps working when the network is down.

- ### On your own infrastructure

  The runtime runs on your devices and servers; ORCHESTRATE can also be operated in your own environment, on OpenShift for example.

- ### Cloud operation in Europe

  If you use logiccloud’s cloud operation, it is hosted in Europe.

- ### Outbound through your proxy

  Edge devices respect the proxy setting of your corporate network (HTTPS_PROXY).

Devices

## Every device identifies itself.

- ### Onboarding with a one-time token

  A device is added to ORCHESTRATE with a token that is valid only once.

- ### A certificate authority per tenant

  Every device receives a certificate from your tenant’s CA — renewable, revocable, with a warning 30 days before expiry.

- ### What arrives is checked

  Rolled-out content is referenced by sha256 checksums; the device checks what it has loaded. Device requests are signed (HTTP Message Signatures, RFC 9421).

Users & permissions

## Roles instead of master keys.

- ### Fixed roles

  In ORCHESTRATE: admin, operator and viewer. Approving individual rollout stages is reserved for admins.

- ### Single sign-on

  In ORCHESTRATE via OpenID Connect — with your company’s identity provider if you wish.

- ### Access to project and HMI

  Only those a project is shared with can see it. In licensed cloud operation, only users with the role “View HMI” can operate an HMI.

Evidence

## Every change traceable.

- ### Immutable audit log

  Who changed what, and when — with IP address and changed fields, exportable as CSV.

- ### Versioned builds

  Every build of a project is kept; every rolled-out application version is immutably indexed.

- ### Separate tenants

  In ORCHESTRATE, customers and teams work strictly separated on one shared platform, each tenant with its own branding.

## Frequently asked questions about security and data sovereignty

Does the control keep running if the cloud cannot be reached?

Yes, if it runs at the edge: the runtime works locally on the device. You need the cloud for engineering, rollouts and monitoring.

What may an AI agent do?

Through the agent-kit, an agent works with the same permissions as the user or API key it is connected with. A server can be started read-only; deleting requires the name as confirmation. That the agent shows a dry run and asks before every rollout is part of its instructions — batch approvals in ORCHESTRATE stay with admins in any case.

Is logiccloud CRA-compliant?

The platform provides the capabilities the Cyber Resilience Act calls for: updates for the support period, versioned builds, device and access management, and a log of every change. Conformity of the end product remains the manufacturer’s responsibility. More in the [CRA knowledge center](https://logiccloud.com/en/cra/).

## Questions from your IT security team?

Bring your requirements along — we will go through them point by point in a technical call.

[Book a technical call](https://logiccloud.com/en/contact/) [Request a demo](https://logiccloud.com/en/demo/)