Security you can explain to your IT and OT teams
Shop-floor stations sit on plant networks next to production equipment. Here is how Oztis protects them, in plain terms. We only list what the product does today.
Every station has its own certificate
There is no shared password or key baked into a fleet of stations. Each one proves who it is on its own.
- The USB stick carries only an enrollment tokenThe token lets a PC ask to join your organization. It expires, and you can revoke it at any time. Stations that already joined keep working.
- The station creates its own keyOn first start, the station generates a private key that never leaves it, and receives a certificate unique to that device.
- TPM when presentThe station’s key and data live on an encrypted partition. On PCs with a TPM 2.0 chip, that partition is sealed to the TPM, so only that PC can unlock it. Without a TPM, the encryption protects against casual disk theft only.
- Approval, if you want itAn enrollment token can require an admin to approve each new station before it gets a role.
- Revoke a stationDisable or delete a station in the console and its certificate stops working.
A station only runs what Oztis signed
A station’s role, layout and settings arrive as one configuration file, signed by the Oztis platform.
- Signature checked before anything changesThe station verifies the signature first. A configuration that doesn’t verify is never applied.
- Downloads checked by hashFiles referenced by the configuration, including system images, are verified against their expected hash.
- Secrets go only where they are neededValues such as Wi-Fi passwords are stored encrypted and included only in the configuration of the stations that use them.
Read-only, verified and hard to wander out of
The station OS is built for one job: show your apps, and nothing else.
- Read-only system imageThe system is a read-only image verified block by block as it is read (dm-verity). A modified image doesn’t boot.
- A/B updates with rollbackUpdates go to a second slot and boot on trial. If the new version doesn’t start and check in, the station returns to the previous one.
- Encrypted data partitionConfiguration cache and logs live on an encrypted partition, unlocked by the TPM when the PC has one.
- Locked-down kiosk sessionNo terminal switching, no system keys, no browser developer tools, downloads or file pickers. No package manager, SSH server or compilers on the station.
Outbound HTTPS only
Stations open connections to Oztis. Nothing on a station listens for connections from the plant network.
- Port 443, outboundStations need outbound HTTPS. A proxy can be set by policy.
- Mutual TLS for station trafficEvery request from a station is authenticated with its own certificate.
- Remote access through a relayScreenshots and the remote shell run over the station’s outbound connection. The remote shell is off unless a policy turns it on, and it runs as a restricted support user.
You can see who did what, including us
The audit log in your console records every change and every remote session.
- Complete audit logEvery change to devices, groups, roles and policies, and every remote session: who, when, which station, and for how long.
- Oztis staff access is always loggedWhen Oztis support opens your console to help, a banner shows it in your console, and every action is recorded in your own audit log, as well as in ours.
- Roles and two-step verificationGive each person the role they need. Owners can require two-step verification for everyone in the organization.
- Scoped API keysAPI keys are shown once, can be limited in scope, and can be revoked at any time.
Your data stays yours
Each customer’s devices, configuration and records are separated from every other customer’s.
- Isolation in the databaseCustomer data is separated with row-level security in the database itself, in addition to checks in the application.
- Installers are per organizationA USB installer can only join stations to the organization that created it.
- Encrypted in transitAll traffic between stations, browsers and Oztis uses HTTPS.
Where we are today
Oztis is in beta. We don’t hold security certifications yet, and an independent security review is still ahead of us. During the beta, Secure Boot must be turned off on station PCs; support for signed boot is planned. If your security team has questions, sign in and use Help in the console to reach us.
See it on your own network
Enroll one station for free and check the traffic, the certificates and the audit log yourself.