Built For
Critical
Infrastructure.

Yes. All data between your gateway and the Merobix cloud is encrypted with TLS - 1.2 minimum, 1.3 preferred, the same standard used by major banks. Data is never transmitted in plaintext at any point in the pipeline, from sensor reading to browser dashboard.

No. Isolation is enforced at the database layer with PostgreSQL Row-Level Security on dozens of tables - the policies are designed so one customer's query returns only that customer's rows, even if application code were bypassed. Historian data and MQTT topics are also scoped per customer with per-device credentials and topic ACLs.

No. The Merobix gateway initiates all connections outbound over HTTPS or cellular. No inbound ports need to be opened, no VPN tunnels required, and no changes to your site's firewall. Your OT network stays completely isolated from the internet.

Every user account supports multi-factor authentication - TOTP authenticator apps or FIDO2/WebAuthn hardware keys and passkeys. Sessions use 256-bit random tokens, expire after 8 hours of inactivity, and are capped at 3 concurrent per user. Failed logins trigger persistent per-account and per-IP lockouts. Passwords are hashed with PBKDF2-HMAC-SHA256 at 200,000 iterations - never stored in plaintext.

Access is controlled by role - Viewer, Operator, Engineer, and Admin, plus custom per-company roles and per-site scoping. Each role has strict permission boundaries enforced at the API level. Viewers and operators can work with live data but cannot change configurations. Only admins can add users or modify alert thresholds. Logins, configuration changes, and alert acknowledgments are logged in an HMAC-chained, tamper-evident audit trail.

The gateway buffers data locally during any outage and automatically syncs when connectivity is restored. You will receive an offline alert via SMS and email, typically within a minute of the gateway going dark. Your PLC and local control logic continue to operate independently of the cloud - Merobix is a monitoring layer, not a control dependency.

Modbus RTU and TCP don't have native encryption - that's a known limitation of the protocol. Merobix handles this by keeping all Modbus traffic on your private local network or serial bus. The gateway reads locally and encrypts data before it ever leaves your site. The Modbus protocol itself never touches the internet.

Users register with their company email domain. New registrations are held in a pending state and require explicit approval from your company admin or a Merobix superadmin before access is granted. No self-service access to live operational data - every account is verified before activation.

Merobix superadmin accounts are restricted to the management portal only - they cannot log into your SCADA dashboard or view your operational data. Access to customer data for support purposes requires documented justification and is always logged in the audit trail.

Contact [email protected] immediately. We can revoke all active sessions for your account, force password resets for all users, and provide a full audit log export on request. We take security incidents seriously and respond promptly during business hours.

Not yet - and we won't claim to be until an independent audit is complete. Merobix runs a SOC 2 readiness program with evidence collection, maps its controls to IEC 62443 and NIST SP 800-82, and runs regular security testing in its ongoing validation program. We publish exactly where we are rather than overstating certifications, and we're happy to share our current control documentation with your security team under NDA.