Threat models for every product
Each product and major feature starts with a written threat model covering its interfaces, data and failure modes, and the model is revisited whenever the design changes.
Security & Trust Center
What touches your network, and how it is secured
For IT and OT security leads — how Perflens devices and software are developed, hardened and updated, where your data lives, and how to report a vulnerability to us.
Our approach
OT device security starts with what we leave out
Every device you add to an OT network is one more thing to defend. We design the Edge Stack to be as small a target as we can make it: no inbound internet connections, no services that are not needed, no shared passwords, and nothing that has to leave your site for the system to work.
Where we reference standards, we mean it precisely. Our development process is aligned with IEC 62443-4-1, which sets requirements for a secure product development lifecycle, and our devices are designed in line with the component requirements of IEC 62443-4-2. That is alignment, not certification: we do not hold, and do not claim, certification against either part.
If you need help applying the same thinking to your own network or your own products, see Edge & OT Security.
How we build
Secure development and device hardening
Our hardening checklist for edge devices describes the same controls from the buyer's side of the table.
Reviewed, reproducible builds
Code review on every change, dependency and vulnerability scanning in the build pipeline, and firmware images built from a controlled, reproducible configuration.
Hardened by default
Unused services and ports disabled, debug interfaces closed on production units, unique credentials for every device and processes that run with the least privilege they need.
Tested at the interfaces
Before release, every network and fieldbus interface a device exposes is tested with malformed and unexpected traffic, not only with the messages it was designed for.
On every Gatepoint
Device security controls
- Secure boot
- Only Perflens-signed bootloader, kernel and system images will start; a modified image is refused at boot
- TPM 2.0
- Device identity and keys held in the TPM, used for enrollment, encrypted storage and mutually authenticated connections
- Signed A/B updates
- Updates are verified, written to the inactive partition and switched only after checks pass; a failed health check rolls back automatically
- Storage
- Data partitions encrypted at rest, with keys sealed to the TPM
- Network exposure
- Only documented ports open, each listed with direction and purpose in the network design you receive
- Accounts
- No default or shared passwords; Console access through SSO and role-based permissions
- Logging
- Security events and audit entries forwarded to your SIEM over syslog
Your data
Data handling and residency
On-premise by default. Images, signals, inspection results and trained models are stored on the Gatepoint or your site server. Nothing is sent off site unless you configure it, and the system does not depend on any off-site service to inspect, alert or display.
You decide what leaves. If you enable remote support, that connection carries device health data and the support session itself. If you run multi-site aggregation, data goes to a Perflens Console instance in your own private-cloud tenancy. Neither is required.
You own it. Hardware, data and trained models belong to you. Retention periods are set per data type, exports are available at any time in open formats, and at the end of a contract we confirm in writing what data, if any, we hold and delete it on request.
Minimal personal data. Occupancy sensing in the Facility module produces counts, not identities. Questions about personal data go to privacy@perflens.com.
Remote access
Outbound-only, and yours to switch off
Outbound only
The Gatepoint opens an encrypted connection out to our support service. There are no inbound ports, no VPN appliance on your firewall and no port forwarding.
Customer-switchable
Turn remote access on or off from Console, or wire a key switch to a Gatepoint input if you prefer a physical control. Off means off — no tunnel and no exceptions.
Named and logged
Only named Perflens engineers using multi-factor authentication can open a session, and every session is recorded in the audit log with who connected, when and what changed.
Works air-gapped
If remote access stays off, updates arrive as signed offline packages and support happens on site or over a screen share that you control.
Connections
Every connection, listed
This is the complete set of connections an Edge Stack deployment can make. Your site's network design shows which ones are in use, and the integration specification fixes the details.
| Connection | Direction | Default | Who controls it |
|---|---|---|---|
| Users to Perflens Console | Inbound from your plant network, HTTPS with SSO | On | Your IT team, through your identity provider |
| Gatepoint to PLC and fieldbus | Inside the cell zone only | On | Your controls team, per the integration specification |
| Feeds to MES, historian and CMMS | From the site zone to your own systems | As configured | You, per the integration specification |
| Perflens remote support | Outbound only, encrypted | Your choice at commissioning | You, from Console or a key switch |
| Multi-site aggregation | Outbound to your private-cloud tenancy | Off | You |
| Updates | Over the remote-support link, or as signed offline packages | Scheduled in your maintenance window | You approve; we prepare and verify |
Software supply chain
SBOMs and vulnerability management
You cannot defend what you cannot see. Every release ships with a record of what is inside it.
- A software bill of materials (SBOM) for every firmware and Console release, available to customers in a machine-readable format
- Continuous monitoring of newly published vulnerabilities against those SBOMs
- Security advisories sent to affected customers with severity, affected versions, mitigations and the fix
- Fixes delivered as signed A/B updates, scheduled in your maintenance window or applied offline
- A written network design for every site, listing devices, ports, directions and zones
- Security questionnaires answered by our security team, led by our Head of Security
Coordinated disclosure
How to report a vulnerability
We welcome reports from researchers, customers and anyone else who finds a weakness in a Perflens product. Email security@perflens.com rather than the support line. If you act in good faith and follow this process, we treat your report as help, not as an attack.
-
Send us the details
Tell us the affected product and version, what you found, the steps to reproduce it and the impact you expect. Proof-of-concept code is welcome. Please don't access, keep or share anyone else's data while testing.
-
We acknowledge
A member of our security team confirms receipt and gives you a named contact for the rest of the process.
-
We confirm and fix
We reproduce the issue, assess its severity, keep you informed as the fix progresses and notify affected customers before anything is made public.
-
We disclose together
We ask that you allow up to 90 days from your report before publishing, and we aim to release a fix and an advisory sooner. With your permission, we credit you by name in the advisory.
FAQ
Questions we hear often
Is Perflens certified to IEC 62443?
No. We align our development process with IEC 62443-4-1 and design our devices in line with IEC 62443-4-2 component requirements, and we can walk your team through how. We do not claim certification and we will not blur the difference.
Can the Edge Stack run fully air-gapped?
Yes. Inspection, monitoring, Console and alerting all run on site. Updates arrive as signed offline packages, and support happens on site or over a screen share you control. Our field note on air-gapped AI covers the trade-offs.
Will you complete our security questionnaire?
Yes. Send it to security@perflens.com. Our security team completes it, usually together with a draft network design for your site so your reviewers can see every connection.
Can we review an SBOM before we buy?
SBOMs are provided to customers for every release. During an evaluation, we can walk your security team through a current SBOM under a non-disclosure agreement.
What does the remote-support link send?
Device health data such as temperatures, storage, model status and update state, plus the content of a support session while one is open. It does not stream images or production data unless an engineer opens them during a session you have enabled.
Bring your security team in early
We would rather answer your OT security questions before a purchase order than after one. Our Head of Security can join a call with your IT and OT teams.