Trust & security
Straight answers, before the call.
The people who have to say yes before Winze touches a plant — the OT engineer, the security lead — ask the same six questions. Here are the real answers.
Data flows one way
Read-only by design: nothing writes to your control systems.
- Control systems (PLCs, SCADA)
- OPC-UA server, already on site
- Edge connector, reads only
- Winze, your isolated tenant
- A person acts on the advice
No write path back, ever.
Tenant isolation
Enforced at the database; data never moves between customers.
Your region
Data stays in the region you require: Australia today, more as they are built.
Your model provider
You choose who runs the analysis.
One rule for all seven
Nothing is trusted until a person says so.
01
Propose
a model suggests
02
Preview
rows shown first
03
Approve
a named person
04
Quarantine
held, not dropped
Every way data comes in, from the plant floor to a photo from the field, follows it: a model may propose what a source means, the rows are shown first, a named person approves, and anything that fails a check is held in quarantine, not dropped.
Read-only by design
- Winze's connectors expose no write, control or configuration operation into a site system — not a feature flag, a property of the interface itself. They run inside the site network with outbound-only connectivity: nothing inbound is required, and nothing Winze does can change a setpoint, start a motor or push configuration to a PLC.
Passive first
- Discovery is passive by default. Any active step is rate-limited, and anything that sweeps a network for devices needs a site owner’s recorded sign-off before it runs. Winze watches; it does not probe uninvited.
Tenant isolation
- Every table that holds a customer’s data carries a tenant id and a row-level security policy that enforces it at the database, not just in application code. A session for one tenant cannot see, and cannot be made to see, another tenant’s rows — checked in CI on every table, every time.
Data residency
- A tenant can require that its storage and inference stay in a named region. Available today: Australia, with more regions added as they’re built — stated plainly, not implied as a global choice that doesn’t exist yet.
Choose your model provider
- Every model call goes through one provider-neutral gateway with adapters for Anthropic, OpenAI, Azure OpenAI, Google, and OpenAI-compatible self-hosted servers. A tenant can restrict inference to the providers it has approved, turn off prompt and response logging, and be assured no tenant data is used to train anyone’s model.
Everything is audited
- Every tool call, every adjudication, every question answered, every admin change and every export is logged immutably with who did it, when, and what it changed. An auditor or a Tenant Admin can read the whole trail; nobody can edit it. Every figure on screen carries the same discipline: marked Verified with the tool that answered it, with its evidence one click away.
In your language
- English, Spanish, Brazilian Portuguese, Canadian French and Greek, across the whole product — the menu, the banners, the chat prompts.
