No inbound ports. No controller writes.
What AssetIQ connects to, what it never does, and what is recorded. Written for the questions a cyber review asks.
What we connect to
Your BMS station publishes outbound to AssetIQ, or an AssetIQ edge reads the equipment directly, on its own link by default. One connection, one agreed point list, from discovery.
What we never do
Write to a controller. Open an inbound port.
Read-only by architecture, not by policy
There is no write path from AssetIQ to your equipment or your BMS, so there is nothing for a policy to govern. The layer reads points and publishes work; it cannot change a setpoint, a schedule or a priority.
Where it runs
Hosted on AWS. Your data is processed and stored in our environment there; nothing of ours runs on your premises except an edge where you choose one. The edge runs on its own link by default, or on an uplink you provide.
In transit
Encrypted, outbound only, from your side to ours. The architecture chart is the whole of it.
The whole connection, drawn once.
Who sees what
Five roles: Org Owner, Facilities Manager, Technician, Viewer, and Vendor Technician. A vendor technician sees only the work orders assigned to them.
What is recorded
An append-only record of band changes, approvals, access grants and model installs, with who and when. Nothing on it is edited or deleted after the fact.
Your data
Your data is yours. Export on request.
What we don't claim
We make no certification claims. We answer security questionnaires — ask for ours, and bring yours to discovery.