Skip to content
Ryedore Logo
Theme
ContactRequest Demo
Servers inside a plant’s own control room

Security & compliance

Your data never leaves your infrastructure. And we say exactly which certifications we hold.

Everything runs on your hardware; nothing leaves. Below: the principles, the picture, the controls — and a certification register with the real status of each item: aligned, architecture‑ready, in progress, or planned.

See the registerAsk our security team
four principles

On your hardware, by design

On‑premises only

Every byte of your operational data stays inside your infrastructure. No cloud path exists to remove.

Residency — attested, not asserted

Data residency is fail‑closed and recorded in a signed attestation you can inspect. Fully air‑gapped deployment is supported.

Complete data sovereignty

You own data, model weights, predictions and outputs. Ryedore never accesses your operational data.

Strong encryption by default

AES‑256 at rest, TLS 1.3 in transit; every inter‑service link encrypted.

in one picture

Data never leaves — and it still learns

Your data, the model, the predictions and the learning loop stay inside your boundary; there is no path to a vendor cloud.

YOUR PLANT · YOUR NETWORK · AIR‑GAP CAPABLEYour datasensors · historian · CMMSThe modelruns and learns herePredictionswith reasoning traceslearns here — from your labels, without forgettingsigned audit chain · sub‑10 ms serving · never‑degrade gate — all insidevendor cloudno data egressno raw data, no model,no predictions leave
Data sovereignty as a picture: everything that matters lives and learns inside your boundary.

swipe → to see the whole diagram

the honest register

Certifications and frameworks — with their real status

This table is the site‑wide source of truth. Other pages link here rather than restating it.

FrameworkStatusWhat it means hereRelevant to
NIST Cybersecurity FrameworkAlignedArchitecture follows the CSF core functions: identify, protect, detect, respond, recover.All industries
IEC 62443AlignedIndustrial automation and control‑system security: defence in depth, zone / conduit model.Manufacturing, energy, process
GDPR / CCPAArchitecture readyOn‑premises deployment keeps operational data in your jurisdiction; privacy‑by‑design personal‑data handling.All industries
HIPAAArchitecture readyOn‑premises residency and access control satisfy data‑residency requirements; BAA available.Healthcare
ISO 27001In progressInformation‑security management system; formal audit planned.All industries
SOC 2 Type IIPlannedSecurity, availability and confidentiality controls; audit engagement scheduled.Enterprise buyers
FDA 21 CFR Part 11 packPlanned · Q3 2026Electronic signatures and audit‑ready documentation module (see Pricing add‑ons).Pharma, med‑device
NERC CIP packPlanned · Q3 2026Critical‑infrastructure protection alignment and regulatory reporting module.Utilities
OSHA / ISO 55000 packsPlanned · Q4 2026Safety and asset‑management reporting modules.Manufacturing, mining, process
the data boundary, exactly

What it reads — and what it never touches

The shortest security review is a precise list. This is ours.

Reads — read-only
  • Historian and SCADA process values — read-only connections
  • Sensor telemetry from the equipment being watched
  • CMMS work-order history, for the failure flywheel
  • Labels your own team confirms — the only ground truth it trusts

The one write-back: a work-order draft into your CMMS — after a human approves it.

Never touches
  • Control systems — no PLC or DCS writes, ever
  • Personal data — no video, no badges, no people analytics
  • Financial and ERP systems
  • Anything outside your boundary — no egress, no cloud path, no telemetry without an explicit opt-in

Residency is enforced fail-closed: if the boundary check cannot pass, the operation refuses rather than proceeds.

What the residency attestation records

The platform generates a signed attestation on your hardware recording that residency was enforced: the enforcement mode (fail-closed), the boundary checks performed and their results, the classes of data present, the deployment identity and timestamp — and a cryptographic signature over all of it. Your security team can inspect it like any other artifact; the format above is described conceptually, the file itself is produced only inside your deployment.

controls

Four control areas, stated plainly

Access control

  • Least‑privilege permissions
  • Multi‑factor authentication
  • Active Directory / LDAP integration
  • Session timeout policies
  • Full audit trail of user actions

Network

  • Air‑gapped deployment supported
  • No inbound or outbound internet required
  • Containerised services with network isolation
  • Signed API tokens with rotation
  • Rate limiting on management interfaces

Data protection

  • AES‑256 at rest, TLS 1.3 in transit
  • Encrypted backups with configurable retention
  • Key management with HSM support
  • Data sanitisation on decommission

Operations

  • Containerised delivery with cryptographic image signing
  • Customer‑controlled updates and rollback
  • No remote access or telemetry without explicit opt‑in
  • Immutable audit logs
  • Vulnerability scanning in the build pipeline
ai safety

The model is checked, signed and gated — and a human decides

No autonomous safety‑critical action; every prediction explains itself; nothing is collected without opt‑in.

Signed audit chain

Every prediction and every model promotion is recorded in a signed, tamper‑evident chain — the same discipline as our public benchmark bundle.

Never‑degrade gate

A new model version must not be worse on any task, must meet its serving budget and calibration checks, or it is blocked — with a log.

Human in the loop

Actions are proposals that pass six checks and a person; explainable outputs with confidence and contributing factors; no telemetry without opt‑in.

The gate log →The six checks →
by industry

What regulated industries need — and get

Healthcare
  • · HIPAA‑ready architecture, on‑premises residency
  • · Clinical vs administrative roles
  • · Immutable audit logs for inspection
  • · BAA available
Energy & utilities
  • · NERC CIP alignment for bulk‑electric operations
  • · Air‑gapped deployment for SCADA / ICS
  • · No external network dependencies
  • · Encrypted inter‑component communication
Defence, aerospace, nuclear
  • · Fully air‑gapped, zero internet dependency
  • · Containerised deployment for secure enclaves
  • · Cryptographic image signing
  • · MANUAL‑approval tier floor: no automated action, ever
Manufacturing & process
  • · IEC 62443 zone / conduit alignment
  • · OT network isolation
  • · Historian / SCADA read‑only integration
  • · Signed audit chain for every prediction
what the round builds here

Isolated — and learning together

Sovereignty today is isolation. The next step keeps every site isolated and still lets every site learn from every other: the collective immune system. roadmap · not shipped

program 2

Privacy‑preserving learning across sites, with differential privacy

today · measured
Each site learns from its own labels inside its boundary; residency is fail‑closed; Ryedore never sees a sensor value.
next
Secure aggregation of model updates with differential privacy and signed learning rounds; what one site learns about a failure is distilled into the shared model — a new site starts with what every other site has taught it, and no raw data moves.
proof point
Signed learning rounds in the verification bundle; measured warm‑start lift for a new site.

Funded by the growth round — what the round builds, all ten programs →

We don’t claim a badge we don’t hold.

Aligned, architecture‑ready, in progress, planned — four words, used honestly, everywhere on this site.

where next

For the security review

questions security teams ask

Six straight answers for the questionnaire

Does any data ever leave our site?
No. Data, model weights, predictions and the learning loop stay inside your boundary; the platform runs air‑gapped if you need it. There is no telemetry unless you explicitly opt in.
Which certifications do you hold?
We state status honestly: NIST CSF and IEC 62443 aligned; GDPR/CCPA and HIPAA architecture‑ready; ISO 27001 in progress; SOC 2 Type II planned; FDA, NERC, OSHA and ISO 55000 packs on the 2026 roadmap. No badge on this site says ‘certified’ unless it is.
Can the AI act on the plant by itself?
No. Actions are proposals that pass six checks and a human approval; refusals are logged. Aerospace, defence and nuclear run at a manual‑approval floor.
How do updates reach an air‑gapped site?
As signed update bundles that your team applies — and can roll back — on your schedule. Every image is cryptographically signed; nothing is pushed, and no inbound or outbound internet is required.
Who at Ryedore can see our data?
Nobody. There is no remote access and no telemetry unless you explicitly opt in, and residency is enforced fail‑closed and recorded in a signed attestation. We never see a sensor value.
What does our IT team need to provide?
Hardware inside your network for the containerised services, read‑only access to the historian / SCADA / CMMS you already run, and directory integration (Active Directory / LDAP) for single sign‑on. No new outbound connections.

Send us your security questionnaire.

We answer it with statuses, not adjectives — and we’ll walk your team through the air‑gapped deployment.

Contact securityHow the platform is gated