The IT Review Pack, No NDA Required

Each connector reads only what it is scoped to read, and that scope is visible to your admins inside the product. It is not something we set once and keep to ourselves.

What leaves the plant:

• Process tags from the historian, SCADA, or controller, limited to the tags in scope.
• Event and state data: downtime events, fault codes, machine states, and their transitions.
• Counts and timestamps: good parts, rejects, cycle boundaries, and when each occurred.
• Cost rates you provide, so dollar impact is calculated on your numbers rather than our assumptions.

What does not leave the plant:

• Control logic. We do not read ladder, function blocks, or program files.
• Recipe IP. Process recipes are not part of what a connector is scoped to read.
• Employee personal data. None is collected by default.

What does move is encrypted in transit with TLS 1.3 and at rest with AES-256. If your reviewer wants the tag-level answer rather than the category-level answer, ask for the exact list before you sign anything. That is a reasonable request and we should be able to produce it.

If the connection drops. Nothing, on your floor. KaizenFlow observes - it does not control - so a connectivity outage never stops a line. Analytics resume when the connection does; where an edge adapter is deployed, reads continue locally and sync when the link returns. The exact behavior for your topology is covered in the security brief.

If KaizenFlow is down. We target 99.9% uptime, and if we miss it, your line does not care. An outage on our side costs you analytics for the duration. It does not cost you production, because we introduce no single point of failure into anything that runs.

On troubleshooting a cloud service. A fair criticism of any cloud dependency is that it makes it harder to work out where a connection or latency problem started. That criticism holds, and we are not going to argue it away. What we can narrow is the blast radius: because KaizenFlow is not in the control path, a latency or connectivity problem in our direction is an analytics problem to be diagnosed on a normal timescale, not a production incident with a line down while someone bisects the network.

The standard platform is multi-tenant with strict logical isolation. Every database query is scoped by tenant ID, so one organization's manufacturing data is not reachable by another. Isolation boundaries are verified through regular security review.

Data is encrypted in transit with TLS 1.3 and at rest with AES-256. Enterprise deployments add private VPC isolation and support data-residency requirements, which is the option to look at if logical isolation alone does not clear your bar. It is worth being direct about the tradeoff: logical isolation is a strong control, and it is not physical isolation. If your policy requires the latter, price the Enterprise path from the start rather than discovering it in month three.

AI analysis runs through vetted model providers, specifically OpenAI and Anthropic, under contractual data-protection obligations. We do not sell your data, and we do not use it to train third-party models.

The part most vendors bury, stated here instead: aggregated, anonymized benchmarks may be used to improve the platform. That is set out in our terms and you should read the clause rather than take our summary of it. If aggregated benchmarking is a problem for your legal team, raise it in the first call, not the last.

AI output is advisory. Final decisions remain with your team, which is also why every recommendation is attributable and logged. On accuracy, we do not quote a fixed accuracy number, because a number quoted out of context is close to meaningless in a plant. We validate forecasts against real outcomes instead, and during a pilot those validations are yours to inspect.

If you end up on a call, these are the questions worth your time. Some of them we would rather not get. Ask them anyway, and treat a dodge as data.

• Show me the exact tag list you will read on line 3, before we sign anything.
• What is your incident response if a connector credential leaks? Who is notified, on what clock?
• Who at KaizenFlow can see our data, under what circumstances, and is that access logged where we can see it?
• You are not SOC 2 certified. What is the target date, who is the auditor, and what happens to our agreement if it slips?
• Which of your 43-plus connectors have you actually run against a live plant, and which would be new for us?
• What does the edge adapter run on, what does it talk to, and what does it need open?
• What happens to our data if KaizenFlow is acquired, or shuts down?
• If we terminate, what exactly is deleted at day 30, and how would we verify it?
• Name a plant you should not have sold to.

We are at design-partner stage with no customers to point you at, which means the usual reference-call shortcut is not available to you. Adversarial questions are the substitute. They are a fair trade only if we answer them straight, and that is on us.

Does this touch our OT or control network? Only in the read direction. Connectors open outbound connections from your network and read from the sources you scope: PLC, SCADA, historian, MES, or ERP. KaizenFlow does not write to PLCs and does not send commands to the floor, and it never sits inline with anything that runs a line. If a connector stops, production does not notice.

Do you install anything on our machines? No agents on machines. Connectors read from systems that already expose data over OPC-UA, MQTT, Modbus TCP and RTU, REST, ODBC/SQL, MTConnect, FANUC FOCAS, or CSV/SFTP. Where a plant runs controllers too old to reach that way, a lightweight edge adapter is used to read them. Nothing is installed on a PLC or an HMI, and no control logic is modified.

Can we run this fully on-premise or air-gapped? Not fully air-gapped, and we will not pretend otherwise. The standard platform is multi-tenant cloud with strict logical isolation, where every query is scoped by tenant ID. Enterprise deployments support private VPC isolation and data-residency requirements. A fully air-gapped deployment is not what we offer today, so if that is a hard requirement, we are not your vendor.

Are you SOC 2 certified? No. We operate to SOC 2 Type II and ISO 27001 control frameworks. We are not yet certified and claim no certification, and certification work is on our roadmap. If a signed SOC 2 report is a hard procurement gate today, we do not clear it. What exists today is control documentation, architecture diagrams, the subprocessor list, and data-flow documentation, all shared in the security brief.

What are your subprocessors? AI analysis runs through OpenAI and Anthropic under contractual data-protection obligations. We do not sell your data or use it to train third-party models. The full subprocessor list is maintained in our Privacy Policy, and the current version is included in the security brief.