Trust Center
Designed for networks that do not talk to the internet.
PlantGuard is a single Windows service with an embedded runtime and a local database, installed on a server the customer owns. This page states what the shipped software does — not what a brochure would like it to do. Where a capability is optional, partial or not yet built, it says so.
Verified against PlantGuard.ai application source, September 2026. Questions and corrections: security disclosure · security questionnaire.
Deployment architecture
One Windows server inside the plant network. No agents on OT endpoints, no cloud tenant, no account with PlantGuard needed to install, license, update or ask the AI.
On-premises, customer-controlled
Installed by an Inno Setup package on Windows 10/11 Pro/Enterprise or Windows Server 2016+ (64-bit). Runs as the PlantGuardAI Windows service with a bundled Python runtime and an offline wheelhouse. The customer owns the server, the operating system, the accounts and the backups.
Air-gap operation
Installation, licensing, updates and the optional AI engine work with no internet route. The application makes no outbound connection unless an administrator configures an integration that requires one (see data handling).
Local processing, local database
All collection, correlation, scoring, planning and reporting run on that server against a local SQLite database. Nothing is queued to, cached in or mirrored to any PlantGuard system.
Optional local AI
A second service, PlantGuard-LLM, runs a llama.cpp model on the same server. It is optional; the product is complete without it. Cloud AI providers can be enabled by an administrator but are never required and are off by default.
What it reads
Devices over SNMP v2c/v3, SSH and WMI; Active Directory over LDAPS; syslog (UDP 514) and SNMP traps (UDP 162) received on the server; backup, endpoint, physical-access and vulnerability-scanner consoles through their own APIs when configured. The Tripwire IP360 connector is read-only: it reads audit results, per-host scores and the scanner's asset list and never starts a scan or writes to the scanner. It talks to the scanner over HTTPS with certificate verification and refuses to send its credential over plain HTTP (since v7.3.11).
What it produces
A browser dashboard served by the PlantGuard service, findings and reports (PDF / CSV / Excel) written on the server, and optional event forwarding to the customer's SIEM in CEF or JSON over syslog.
Data handling
When PlantGuard is deployed as documented (no optional cloud integration enabled), the following never leaves the customer's environment: device configurations and configuration backups, stored credentials, the asset inventory, monitoring events, syslog and trap content, Active Directory data, findings, scores, plans, reports, and every question put to the AI Advisor together with its answer.
There is no telemetry, no usage analytics, no crash reporting, no update check and no license-validation call in the application. We verified this by auditing every outbound network call in the source. The complete list of connections the software can make is short and is published here so that a network team can whitelist or block it deliberately.
Every outbound connection the application can make
- Default installation: none.
- If an administrator enables a cloud AI provider (Anthropic or OpenAI): prompts go to that provider's API. Off by default; the local engine is the documented option.
- If an administrator connects Microsoft Defender for Endpoint:
login.microsoftonline.comandapi.securitycenter.microsoft.com. - Customer-side systems only — devices, domain controllers, backup / EDR / PACS consoles, the SIEM — at addresses the administrator enters.
- Never at runtime: package indexes, GitHub, font or script CDNs, image hosts, PlantGuard.ai. Dependencies are downloaded once on a build machine and shipped inside the installer.
Credential security & access control
Passwords
Local account passwords are stored as bcrypt hashes. First sign-in forces a password change. Sign-in is protected by per-username lockout, per-address throttling, an idle timeout (30 minutes by default) and an absolute session limit.
Device credentials at rest
SNMP passphrases, SSH passwords and integration API keys are encrypted with an application master key that is generated on the server at installation and never leaves it. The customer backs the key up; PlantGuard cannot recover it. Stored secrets are never returned by the API, never included in reports, exports or AI answers.
Database at rest
The SQLite database file is encrypted with a separate database key while the service is stopped and decrypted for use while it runs. Operating-system controls (NTFS permissions, BitLocker, host hardening) remain the protection for the running file. We state this precisely because "encrypted database" alone would overstate it.
Role-based access
Two roles — Administrator and read-only Operator — plus per-user tab visibility. Score weights, rule thresholds, planner settings, integrations and users are administrator-only.
Active Directory
Optional AD sign-in and group mapping over LDAPS with certificate verification on by default (a private-CA bundle is supported). Authentication is a simple bind over TLS with the account's UPN. PlantGuard implements no NTLM and computes no MD4 anywhere (directory sign-in since v7.3.2; the Windows application scan since v7.3.6, which found and removed the last library that did); connections to Windows hosts are opened by Windows PowerShell with the operating system's own security provider (Kerberos in a domain). Several domain controllers can be listed for failover.
Audit logging
Sign-ins, every administrative change, every finding action, plan change, credential reveal, report export and AI question is written to the audit log, which is administrator-readable, retention-governed and forwardable to the customer's SIEM.
Browser hardening
The dashboard is served with a Content-Security-Policy of script-src 'self': the browser runs only PlantGuard's own script files — no inline scripts and no eval. Every value that comes from outside (a device hostname, a directory attribute, a controller record) is escaped before it is rendered, and even if an escaping mistake ever let markup through, the policy stops it from executing. Inline styles are still permitted; colours from data go through an allow-list. Since v7.3.10 (v7.3.5 removed eval; v7.3.7–7.3.10 removed the last 290 inline handlers). A test fails the build if any inline script returns.
Transport to the browser
The dashboard is served on TCP 8001 over HTTP by default and switches to HTTPS automatically when a certificate and key are placed in the application's data folder (a generator for a self-signed pair ships with the product; a certificate from the customer's own CA is recommended). Enabling HTTPS is a manual step for the installing administrator today. We do not describe the dashboard as "HTTPS-only" because, out of the box, it is not.
Software integrity, updates and licensing
Offline updates — Ed25519-signed manifests
An update is a zip file carried into the plant by the administrator. Before anything is written, the application checks, in order: that the package manifest carries a valid Ed25519 signature made with the PlantGuard release key (the same key pair that signs licenses; public key embedded in the application), that every file's SHA-256 hash matches the signed manifest, that the version is strictly newer than the running one, that the installed version is one the package was built to upgrade (from_version), and that no path touches the database, keys, license or configuration. Any failure rejects the whole package and the reason is shown; a successful update can be rolled back in one click.
Since v7.3.3. Earlier versions verified the SHA-256 manifest only, which proved the files matched the manifest but not who wrote it; a re-manifested package would have passed. That gap is closed and the test suite carries that exact attack as a regression control. The private release key is held offline and is never in any package or build environment; signing is a separate step on the release machine, and the application refuses an unsigned or altered manifest with no override switch.
Licensing — Ed25519 signed, verified offline
A license is a file signed with PlantGuard's Ed25519 private key and verified on the server with the embedded public key. Perpetual or time-limited, optionally bound to a hostname. No license server is contacted, ever. A 30-day evaluation license is built in.
The private signing key is held offline by PlantGuard and is never part of any installer, update or support bundle.
Installer
A single Inno Setup installer carries the application, the Python runtime and the dependency wheelhouse; its SHA-256 is published in the customer portal. Publisher code-signing of the installer executable is not asserted here: the build pipeline supports it, but a signature is only meaningful once the certificate it was made with is published. When that is the case, the certificate thumbprint will appear on this page.
Configuration backups
Device configuration backups collected by PlantGuard are stored encrypted on the server. A stale or failed backup is itself evidence: it raises a finding, and on a critical asset it raises that asset's priority score.
AI security
AI assists interpretation. It does not replace deterministic evidence.
Local by design
The optional engine is a llama.cpp service on the same Windows server. No external AI API is required, none is configured by default, and the product's findings, scores, plans and reports are produced without any model at all.
Grounded in collected evidence
A question is routed deterministically to the findings, scores, plans and reports that already exist. The model is given those records and asked to phrase them. Every answer cites the finding ids it drew on, and each id is checked against the database before the answer is shown — a citation that does not exist causes the answer to be discarded.
Deterministic findings stay authoritative
The model cannot create a finding, change a severity, alter a score or approve an action. It cannot invent a vulnerability: if the evidence is not there, the product answers PlantGuard does not currently have enough evidence to determine this.
No secrets in the prompt
Stored credentials are excluded from everything the model can see, so they cannot appear in an answer.
AI never executes
In the firmware and patch engines, any command text the model produces is display-only and can never be executed; command sets run only after a named administrator has confirmed them against the vendor's own documentation.
Audited
Every question and the answer's cited evidence are written to the audit log like any other action.
Software supply chain
What we do today, and what is not yet in place. An OT buyer should know both.
In place
- Dependencies are declared, pinned and shipped. Every third-party Python package is pinned to the exact version delivered inside the installer's offline wheelhouse (since v7.3.6; the SBOM generator's check mode fails a release otherwise); the installed product never downloads a package.
- Release integrity. Update manifests are Ed25519-signed with the release key and carry a per-file SHA-256; both are verified before installation. Packages are distributed only through the authenticated customer portal.
- SBOM and notices per release. Each release ships a CycloneDX 1.5 Software Bill of Materials (one component per dependency, exact shipped version, PyPI purl, license, SHA-256 of the shipped wheel) and a third-party notices file, generated offline on the release machine. Provided during evaluation and with every release.
- Deterministic build inputs. The build machine downloads dependencies from the public Python package index and the llama.cpp release page only; nothing else is fetched.
- Automated tests. Every release is built only after the product's automated test suite passes; the suite includes guards for the security properties on this page (no NTLM, no cleartext bind, signed manifests, escaped output, no inline script and no external host in the browser policy).
Not yet in place — stated plainly
- Automated vulnerability scanning in a pipeline. Dependencies are checked against the OSV database with
pip-auditas a documented manual step on the release machine, not by a CI gate. - Published installer code-signing certificate — see software integrity.
- Independent penetration test. None has been commissioned yet. When one is, the summary will be referenced here — never before.
Procurement facts
The answers a security questionnaire asks first, taken from the product documentation and code.
| Deployment model | Self-hosted on-premises Windows service. No SaaS option. |
|---|---|
| Supported operating systems | Windows 10/11 Pro/Enterprise, Windows Server 2016 or later, 64-bit. |
| Hardware | About 2 GB of disk for the application, plus the model file if the local AI engine is used. CPU and memory sizing depends on fleet size and on whether the local model runs; a sizing note is provided during evaluation. |
| Database | Embedded SQLite on the local disk. No external database server to license, patch or reach over the network. |
| Network ports | Inbound: TCP 8001 (dashboard, HTTP or HTTPS), UDP 514 (syslog receiver) and UDP 162 (SNMP traps) — the two listeners can be disabled. Outbound: only to devices and systems the administrator configures (SNMP 161, SSH 22, WMI, LDAPS 636, integration APIs, SIEM syslog). |
| Internet requirement | None for installation, licensing, updates or AI. See data handling for the two optional integrations that use the internet. |
| Air-gap support | Yes — the documented deployment. |
| Authentication | Local accounts (bcrypt) or Active Directory over LDAPS (simple bind with UPN, TLS certificate verification, group-to-role mapping, several controllers for failover). Lockout, throttling, idle and absolute session limits. |
| Backup of PlantGuard itself | The customer backs up the application data folder (database, keys, license, config backups) with their own tooling; the database file is encrypted while the service is stopped. Losing the key files makes stored secrets unrecoverable by design. |
| Update process | Administrator uploads an update zip in the dashboard; Ed25519-signed manifest verified, then per-file SHA-256, strictly-newer and from_version rules; one-click rollback. No automatic updates, no update checks. |
| Licensing model | Perpetual or term license file per plant, Ed25519-signed, verified offline; maintenance term governs update entitlement. 30-day built-in evaluation. |
| Logging and audit | Audit log of every administrative and evidentiary action; daily rotated application logs with retention; forwarding to SIEM as CEF or JSON. |
| High availability | Single-server application. Failover between several AD domain controllers is supported; a warm-standby or clustered PlantGuard server is not offered today. |
| Disaster recovery | Restore the application data folder to a freshly installed server of the same version. Recovery is only as good as the customer's backup of that folder. |
| Support model | E-mail support (support@plantguard.ai) and the customer portal. Response-time targets differ by plan (see pricing) and become commitments only in the signed agreement. |
Enterprise security documentation
Since v7.3.5 these thirteen documents ship inside the product (Help › Documentation › Enterprise Security) and are provided to evaluating organizations before installation under the pilot or evaluation agreement. They are written to the same rule as this page: what the software does and where its limits are, verified against the code of the release they describe. They are not offered as anonymous public downloads.
Request an Enterprise Pilot Send us your security questionnaire
Standards and frameworks
PlantGuard's AD Compliance module scores Group Policy against a 34-check baseline whose checks are cited to NCA ECC-2:2024 and OTCC-1:2022 identity and access controls, and its controls library helps teams extract evidence when assessing against IEC 62443, NIST SP 800-82 and ISO/IEC 27001. That is evidence support for the customer's own assessment — nothing more.
Framework mappings and assessment capabilities are intended to assist organizations with evidence collection and internal assessment. They do not constitute certification, accreditation, or endorsement by the organizations responsible for these frameworks. PlantGuard.ai does not hold, and does not claim, any certification against IEC 62443, NIST SP 800-82, ISO/IEC 27001, NCA ECC or NCA OTCC.