Who it is for
Supervise and work remotely, without letting go of control
For the operations, maintenance, integration and security teams that must work on equipment spread across sites, sometimes behind networks they do not control, without letting go of the rights, the data or the records. Six situations below: three ways of running a fleet, three reasons to want a bastion. You will recognise yourself in at least one.
Prise 1
You run several sites
Plants, installations, depots, each with its machines and its network. The technician who knows how to fix things is at headquarters, the machine that fails is three hundred kilometres away, and each site's IT has its own rules.
What the hub does:
- One fleet per site, partitioned - its machines, its people, its rights - and one screen for all of them.
- Each site's agent calls the hub outbound: nothing to negotiate with the local IT department.
- The technician acts from headquarters - terminal, files, screen or PLC - and the session is traced.
What a fleet is, and what it is for
You run your customers' fleets
Integrator, maintainer, industrial managed-service provider: you run machines that are not yours, for customers who want neither to see each other, nor to leave you an access without knowing what you do with it.
What the hub does:
- One fleet per customer on a single instance, each with its own certificate authority: an identity from one fleet is worth nothing on another.
- Rights per person and per fleet, for your people as for the customer's.
- A log and recorded sessions you can show the customer, and a software bill of materials per machine.
You build machines
Your equipment sits at your customers', behind networks you do not know. You want to know how it is doing, to update it, and to work on it when needed - without asking the customer to open anything.
What the hub does:
- The agent on the machine reports its state and its inventory, and receives its signed updates, rolled out progressively.
- You open a session to the machine without touching the customer's network: no port, no address to ask for.
- When the machine cannot carry the agent as it is, an agent is written for your hardware.
Tell us what equipment, behind which networks. We show you the console on it.
Your machines have no public address
Behind a 4G or 5G router, a NAT, a firewall that lets nothing in, on a site link that changes address whenever it likes. Nobody will give you a fixed address, and nobody will open a port.
What the hub does:
- The agent calls the hub outbound and keeps the channel open; you get in through that channel, without knowing the site's public address.
- The channel comes back on its own after an outage, and a whole fleet reconnects without bringing the hub down.
- What lives behind the agent - PLC, HMI, camera - is reached through it, with nothing installed there.
You must know who did what
A machine has started behaving differently, a customer asks for answers, an audit comes round. You must be able to say who connected, when, to what, and what was done - and the people who come in must not carry the keys to the house in their pocket.
What the hub does:
- Rights are granted by role and by fleet: view, open a session, send a command, deploy, administer.
- Terminal and screen sessions are recorded and replayed; the rest goes into the audit log.
- When you set it up that way, the machines' credentials stay sealed in the hub: the person intervening opens the session without ever receiving the target's password.
You bring in contractors
The line builder, the integrator, the maintenance company: they must be able to work, not to settle in. Opening a VPN for them opens the network; creating an account for them on the machine means forgetting it afterwards.
What the hub does:
- An account that carries its own end date: once it passes the account opens nothing, and a session already open is closed within the hour. Moving the date back lets it in again, with nothing else to undo.
- An access limited to one destination and one duration, revocable in one gesture, with a second factor required by role.
- No account on the machine, no VPN: the contractor goes through the console, and through it only.
- A trace of what they did, replayable, which you keep once they have gone.