Security and reliability

Every change goes through 8 steps

1. Request
2. Validate
3. Approve
4. Pre-check
5. Execute
6. Read back
7. Verify
8. Complete

• The person who requests a change cannot approve it.
• Writes are blocked while the equipment is in manual or in fault, or when the data cannot be trusted.
• Success is decided by the read-back. Without a read-back the result is marked "uncertain", never "done".
• Emergency stop: any role can press it to stop all writes at once; only a manager can release it.

Life safety is monitored, never controlled

Fire alarm, gas monitoring system shut-offs, gas cabinet automatic shut-off and emergency power transfer are always performed by the listed or certified systems themselves. FacilityOS monitors them, verifies that the expected linkage actually happened within its deadline and notifies the right people. It never replaces them and never sends them commands. Electrical protection relays are read-only too.

Security design

• Passwords stored with bcrypt; accounts lock after failed sign-ins and requests are rate-limited per IP; Microsoft Entra ID single sign-on; every permission checked on the server.
• Platform to gateway: TLS only, one account per gateway; every command sent to a gateway carries an Ed25519 signature and a lease epoch, preventing replay and control by a stale node.
• Device credentials and notification secrets encrypted (X25519 + HKDF + AES-GCM); the API never returns them and they never appear in logs.
• The audit log is a hash chain that can be verified for tampering; the audit table is append-only.
• Content Security Policy and security headers on the web app; outgoing notifications cannot reach internal networks or cloud metadata addresses (SSRF protection).
• Sessions sign out after 2 hours without activity.
• Several rounds of security review have been completed, with their findings and fixes recorded.

Reliability

• Control stays in the field: PLCs and DDCs keep running the equipment if the platform is disconnected.
• Gateways connect outward only, so no inbound port has to be opened at the site.
• Store and forward: during an outage the gateway keeps every reading in a durable on-disk journal (by default up to 30 days or 2 GB) and sends the backlog in its original order; nothing is lost or stored twice, and any overflow is reported and shown as a gap.
• Stale data is marked stale and shown as a gap on trends; values are never invented.
• High availability with multi-node primary/standby or active-active operation and automatic takeover; backup and restore; Prometheus metrics.

AI with guard rails

The AI assistant is off by default and needs the platform, the customer and the site to switch it on. What it sends is redacted first and contains no credentials or personal data; the API key is encrypted and write-only, and every request is audited. The public demo uses only a local simulation.