Operator
Run, stop and acknowledge. Cannot change parameters, envelopes or acceptance decisions.
Security
The loop closesinside yourfactory walls.
In brief
Weldeon writes to industrial equipment in a safety-critical process. That imposes obligations beyond ordinary software security — and it starts with the platform working perfectly well with no connection to us at all.
First principle
Air-gapped by default, connected by choice
Perception, reasoning and control all run on a factory edge appliance on your shop-floor network. There is no inbound path from the internet, and the control loop does not depend on an outbound one.
Cloud sync exists — fleet learning, benchmarks, long-horizon genealogy — and it is genuinely useful. But it is opt-in per site and per data class, and turning it off degrades nothing about the welds you make today.
We think this is the only defensible posture for a system that can move a robot.
Control safety
Limits on what the platform may do
Security in a physical process is mostly about authority, not encryption.
- Bounded write authority
- Parameter writes are clamped to the qualified WPS range inside the controller adapter.
- Safety interlocks preserved
- Weldeon never bypasses cell safety systems, light curtains, e-stops or interlocks.
- Confidence thresholds
- Below site-configured confidence the cell stops or drops to advisory.
- Shadow mode
- Read-only operation with decision logging, before any write authority is granted.
- Deviation logging
- Every write, override and stop is recorded before the next pass begins.
- Rollback
- Model and runtime versions are pinned per cell and revert without a site visit.
Data
Where your data lives and who can read it
Part geometry, procedures and NDT history are among the most sensitive assets a fabricator owns.
- Data residency
- Raw sensor, geometry and NDT data remain on site unless you explicitly sync them.
- Tenant isolation
- Cloud tenancies are isolated per customer; cross-site learning is opt-in per data class.
- Encryption
- TLS 1.3 in transit; encryption at rest on the edge appliance and in the tenancy.
- Retention
- Retention windows configurable per data class, with documented deletion.
- Export
- Weld genealogy exports in open, documented formats at any time.
- No training on your IP
- Customer geometry and procedures are not used to train models for other customers without a written agreement.
Access
Roles as they exist in a real shop
Access control that mirrors the authorities your quality system already defines.
Welding engineer
Owns procedures and envelopes. Can change what the platform is permitted to do, within code.
Inspector
Accepts or rejects indications. The only role that can close an NDT decision.
Administrator
Manages users, sites, integrations and sync policy. Cannot approve welds.
Auditor
Read-only across genealogy, deviations and configuration history.
Weldeon support
No standing access. Time-boxed, customer-approved, fully logged sessions only.
Assurance
Our security programme, stated plainly
We would rather tell you what is in place today than imply certifications we have not yet earned.
- 01
Architecture
Edge-first design, bounded authority and tenant isolation are implemented today, and documented in the security note we share under NDA.
- 02
Secure development
Code review, dependency scanning, signed releases and pinned runtimes across the edge fleet.
- 03
Vulnerability handling
A published disclosure address, triage commitments and customer notification thresholds.
- 04
Certifications
SOC 2 Type II and ISO 27001 are on the roadmap and are [ASPIRATIONAL] until independently audited. We will not claim them before then.
- 05
Customer review
We complete security questionnaires, support architecture reviews, and welcome customer-led penetration testing of the edge appliance.
Auditability
The record is the security control
In a code-bound process, the strongest security property is that nothing happened without a record of who or what decided it.
Posture
The numbers that matter
0
bytes that must leave your site for the control loop to close
0
standing Weldeon access to customer environments
100%
of parameter writes bounded by the qualified WPS envelope
TLS 1.3
in transit; encryption at rest on edge and in tenancy
Certification status: SOC 2 Type II and ISO 27001 are [ASPIRATIONAL]. Current controls are described in the security note available under NDA.
“A system that can move a robot should assume it will one day be asked to explain itself.”
Questions
Security questions
-
Not yet. SOC 2 Type II and ISO 27001 are on our roadmap and we will say so clearly the day they are independently audited. Today we share our architecture note, control descriptions and questionnaire responses under NDA.
-
There is no standing access. Support sessions are time-boxed, initiated by you, scoped to a specific issue and fully logged.
-
Nothing changes on the shop floor. The loop is local. Genealogy and telemetry buffer on the appliance and reconcile when connectivity returns.
-
Not for other customers, and not without a written agreement. Models improve on your data for your sites by default; fleet learning is a separate, opt-in decision.
Begin
Bring autonomy to thearc, the fit-up andthe inspection bay.
Book a pilot on one cell or line. We agree the scorecard before we start — first-pass yield, rework hours, defect escapes, takt — and we report against it in the open.