Security

Security approach

Plant Pulse Pro is designed as a multi-tenant production-record system in which PostgreSQL is authoritative and the browser receives only the bounded information needed for the current view. Security is a shared responsibility: the service enforces technical boundaries, while each customer controls authorized users, accurate scope assignments, managed devices and site procedures.

Identity and tenant isolation

• Server-side session validation resolves the signed-in employee and membership scope; browser-supplied role or tenant claims are not treated as authority.
• Customer, company, site, plant and permission checks are repeated at protected request and database boundaries.
• Sensitive service and provider keys remain in server-side secret management and are not returned to the browser.
• Administrative and operational actions use fixed, validated commands rather than an unrestricted browser-to-database tool.

Operational integrity and audit

• Reactor state and batch commands use transactional database functions with expected state or revision checks and idempotency controls.
• Governed actions retain actor, scope, time, reason and correlation evidence appropriate to the workflow.
• Published standards and reason catalogs are versioned so historical records can retain the rule used at the time.
• Authenticated detail responses are private and are not placed in a public shared cache.

Transport, hosting and recovery

Production web traffic is served over HTTPS. Hosting, database, at-rest encryption, backup, point-in-time recovery, region and recovery objectives depend on the contracted deployment tier and must be confirmed for each customer environment; this page does not claim a certification or recovery capability that has not been contractually verified.

Customers should maintain their own approved export and continuity procedures. A monthly business export is not a database backup or disaster-recovery substitute.

AI boundary

AI features are read-only and separately controlled per tenant. The server first calculates permission-scoped metrics, redacts bounded comment samples where enabled, and sends only approved context to a configured provider. Provider keys, cookies, session tokens, arbitrary SQL access and production-write tools are not included. If an external provider is not configured or is unavailable, deterministic output can remain available without claiming that an external model answered.

Customer responsibilities

• Use individual accounts, least-privilege roles and prompt offboarding when staff access changes.
• Protect managed devices and email accounts used for authentication, and report suspected compromise promptly.
• Review master data, reason lists, approvals and integrations before relying on calculated results.
• Confirm deployment-specific retention, backup, recovery, region and optional AI settings before production rollout.

Reporting a security concern

Report a suspected vulnerability, unauthorized access or data incident to hello@plantpulsepro.com with a concise description, affected customer or environment, observed time and safe reproduction details. Do not access another customer's data, disrupt production or publish sensitive details while a report is being investigated.