Skip to main content

Security Overview

MachineMetrics is built for enterprise manufacturers in regulated industries including Aerospace, Defense, and MedTech. Our platform delivers secure, reliable, and auditable functionality designed to meet the operational and compliance needs of enterprise IT and compliance professionals.

Platform Security Summary​

AreaStandard
CertificationISO 27001
InfrastructureAWS (Standard) / AWS GovCloud (Government)
EncryptionAES-256 at rest, TLS 1.2+ in transit
Uptime SLA99.5%
AuthenticationSSO (OIDC); MFA via SSO provider only

ISO 27001 Certification​

MachineMetrics is ISO 27001 certified, demonstrating our commitment to information security management. This certification includes:

  • Annual third-party penetration testing
  • Continuous internal security audits
  • Formal Information Security Management System (ISMS)
  • Controlled access to sensitive data
  • Threat modeling and mitigation procedures
  • Secure development lifecycle (SDLC) practices

Deployment Options for Regulated Environments​

GovCloud (Defense / Government)​

MachineMetrics offers deployment in AWS GovCloud for defense contractors and government agencies:

  • Isolated infrastructure with enhanced access controls
  • US-only data residency
  • Capabilities that support labor tracking and digital signatures

For specific compliance requirements (e.g., CMMC, ITAR), contact your SDM or support@machinemetrics.com to discuss your needs and available documentation.

FDA / MedTech​

For FDA-regulated environments, MachineMetrics supports electronic records and signatures capabilities:

  • Dual authentication with SSO and secure PIN verification
  • Audit logging of all data interactions (timestamp, user ID, event intent)
  • Role-based access controls with read-only restrictions on validated data
  • Separation of system-of-record responsibility to ERP
  • Detailed validation logs and error traceability

GDPR​

MachineMetrics supports GDPR-oriented data protection practices:

  • Customer data ownership
  • Right to data portability
  • Sub-processor disclosure (see Sub-Processors)
  • Data Processing Agreement (DPA) available on request

Data Encryption​

In Transit​

  • All communication uses TLS 1.2 or higher
  • HTTPS only — no plaintext connections
  • Certificate pinning for Edge devices

At Rest​

  • AES-256 encryption for stored data
  • Encrypted database backups
  • Secure key management through AWS KMS

Authentication & Access Control​

Single Sign-On (SSO)​

MachineMetrics integrates with enterprise identity providers using OIDC (OpenID Connect):

  • Enforce corporate password policies
  • Session management aligned with corporate security standards

Supported identity providers include:

  • Okta
  • Azure Active Directory
  • Google Workspace
  • OneLogin
  • Any OIDC-compliant IdP

Role-Based Access Control​

User permissions are managed through defined roles:

RoleAccess Level
ExecutiveFull system access and configuration
ManagerProduction data, reports, most settings
IT AdminAll Manager permissions + SSO, ERP config
SupervisorReports and dashboards, limited settings
KioskDashboard display only (read-only)

Multi-Factor Authentication​

  • MFA is supported only via your SSO provider (e.g., Okta, Azure AD). MachineMetrics does not offer built-in MFA outside of SSO.

Cloud Infrastructure Security​

MachineMetrics is hosted on Amazon Web Services (AWS) in a Virtual Private Cloud (VPC):

  • Resources compartmentalized into public and private subnets
  • Credential-controlled access with least privilege
  • API access controlled by short-lived authentication tokens
  • Passwords hashed (never stored in cleartext)
  • Continuous monitoring and threat detection

Standard Environment​

  • Multi-region AWS deployment
  • Automatic failover and redundancy
  • 99.5% uptime SLA (see your contract or contact support@machinemetrics.com for the full SLA)

GovCloud Environment​

  • Isolated AWS GovCloud infrastructure
  • US-only data residency
  • Enhanced access controls for cleared personnel

Security Program Practices​

MachineMetrics maintains comprehensive security policies including:

Policy AreaDescription
BackupAutomated backup procedures to prevent data loss
EncryptionStandards for data protection at rest and in transit
Change ManagementControlled process for system and product changes
Vulnerability ManagementRegular scanning, penetration testing, patching
Access ControlPrinciples for controlling system access
AuthenticationPassword and account security requirements
Incident ResponseProcedures for security incident handling
Business ContinuityDisaster recovery and operational resilience
Risk ManagementOngoing risk assessment and mitigation
TrainingSecurity awareness for all employees

Continuous Security Monitoring​

MachineMetrics maintains a proactive security posture:

  • Regular internal and third-party security reviews
  • Formal incident response and disaster recovery plans
  • Continuous improvement based on threat intelligence
  • 24/7 infrastructure monitoring
  • Automated security alerting

Reporting Security Vulnerabilities​

If you identify a security vulnerability, please report it via support@machinemetrics.com. Your report will be escalated appropriately.

Include:

  • Detailed description of the vulnerability
  • Steps to reproduce (if applicable)
  • Any relevant screenshots or logs

We appreciate responsible disclosure and will respond promptly to all reports.

Documentation & Audits​

For enterprise IT audits, validation packages, or compliance documentation, contact your Solution Delivery Manager (SDM) or support@machinemetrics.com.

Available documentation includes: