Why Manufacturing Data Security Matters More Than You Think

Engineering data isn't just numbers on a screen. It's a detailed picture of your operation — what equipment you run, how hard you run it, where your vulnerabilities are, and what your maintenance spend looks like. In the wrong hands, it's competitive intelligence.

For manufacturing SMEs evaluating cloud analytics platforms, the security question is usually binary: either they trust the platform or they don't. The problem is that most platforms describe their security in vague terms — "enterprise-grade", "military-grade encryption", "bank-level security" — without explaining what any of that actually means in practice.

We think you deserve better than that. So here's exactly what AWI Analytics does to protect your data, layer by layer, with no ambiguity.

The Seven Layers of Security

Security isn't a single feature. It's a set of overlapping layers, each addressing a different risk. Here's how AWI Analytics is built.

1. Token-Based Authentication (JWT)

Every user session is authenticated using JSON Web Tokens (JWT). When you log in, the platform issues a signed, time-limited token that's required for every subsequent request. There's no persistent session stored on the server — if a token expires or is revoked, access stops immediately. This approach is stateless, scalable, and widely regarded as best practice for modern SaaS applications. Team and role management is built in, so you can control exactly who has access to what within your organisation.

2. Encrypted Connections (HTTPS / TLS)

All data transmitted between your browser and AWI Analytics is encrypted using HTTPS with TLS (Transport Layer Security). No unencrypted HTTP requests are accepted — the platform enforces HTTPS on every connection. On top of this, CORS (Cross-Origin Resource Sharing) origin allowlisting ensures that only authorised frontend domains can communicate with the API. This prevents unauthorised websites or scripts from making requests on behalf of your users.

3. AES-256 Encryption at Rest

All data stored in AWI Analytics is held in AWS S3, where Amazon applies 256-bit Advanced Encryption Standard (AES-256) encryption to all objects by default using server-side encryption (SSE-S3). AES-256 is the same encryption standard used by governments and financial institutions worldwide. AWS manages the encryption keys automatically, meaning your data is encrypted the moment it's written to storage and decrypted only when accessed by an authorised request.

4. Organisation-Scoped Data Isolation

This is one of the most important security measures for a multi-tenant SaaS platform. Every query, every dataset, and every dashboard in AWI Analytics is scoped to your organisation. The platform enforces this at the database query level — it's not just a UI filter that could be bypassed. Your data is never shared with, visible to, or accessible by other accounts on the platform. Full access logging is enabled, providing an audit trail of who accessed what and when.

5. Secure Cloud Infrastructure

AWI Analytics runs on managed cloud infrastructure with TLS termination handled at the platform level. This means the complexity of certificate management, renewal, and secure handshake negotiation is handled automatically — not manually configured in a way that could be misconfigured or forgotten. Automated backups provide redundancy, and the infrastructure is designed for high availability so your data is accessible when you need it.

6. Team Access Controls

Not everyone in your organisation needs the same level of access. AWI Analytics supports invite-based team onboarding with role-based access control (RBAC). You decide who can view data, who can edit, and who can manage settings. This means a site engineer can access the dashboards they need without being able to modify data sources or invite external users. It's granular control without complexity — managed through a simple team settings interface, not a 50-page admin console.

7. You Control the AI Path and the Audit Trail

Three things matter here, in order. Verifiability: every answer is grounded in your own data, with a full audit trail — the exact SQL that ran, the documents and chunks retrieved, the model output, and the verified-answer record. You can inspect any of it. Neutrality: AWI Analytics is LLM-neutral. You bring the AI provider — Anthropic direct, Claude via your AWS Bedrock or Azure tenancy, or Microsoft Copilot — and you can change it. We're the orchestration layer, not the model vendor. BYO-AI economics: because you bring the AI keys, you negotiate the AI contract terms directly (DPA, retention, training opt-out, inference region) with the AI vendor, and the AI cost line is yours to control. AWI itself doesn't train a foundation model on your data — we don't have one. Your operational data is never sold, never shared with other customers, and remains yours to export if you choose to leave.

What This Looks Like in Practice

Security layers are only useful if they work together. Here's what actually happens when a maintenance engineer on your team uses AWI Analytics:

  1. They log in — their credentials are verified and a time-limited JWT token is issued. The connection is encrypted via TLS from the moment they open the browser.
  2. They upload a CSV of sensor data — the file is transmitted over HTTPS, arrives at the server, and is stored in AWS S3 with AES-256 encryption applied automatically. The data is tagged to their organisation.
  3. They ask a question — "What's the vibration trend on Pump 7 this quarter?" The platform retrieves only data belonging to their organisation, generates a grounded answer using RAG, and returns it over the encrypted connection.
  4. Their colleague logs in — if they have view-only access, they can see the dashboard but can't modify data sources or change settings. Access controls enforce this automatically.
  5. An access log records every interaction — who queried what, when, and from where. If you ever need to audit data access, the trail exists.

No step in this process involves your data being visible to another organisation on the AWI platform, transmitted without encryption, or stored in an unencrypted state. When step 3 calls out to an AI provider for the language-model step, that call goes to the AI vendor you bring (Anthropic, AWS Bedrock, Microsoft, etc.) under the enterprise contract you hold with them — not to a shared AWI inference pool.

What We Don't Claim

Honesty about security means being clear about what you don't do as well as what you do. In the interest of transparency:

  • We don't claim "zero trust" architecture. Zero trust is a specific network security model involving mutual TLS, identity verification at every hop, and no implicit trust between services. Our security model uses strong authentication and encryption at every layer. It's robust, but calling it zero trust would be inaccurate.
  • We use third-party services. AWI Analytics uses third-party APIs for AI inference, cloud storage, and infrastructure. Your data passes through these services as part of normal platform operation. We select providers with strong security track records, but we won't pretend your data never touches a third-party system.
  • We're not SOC 2 certified (yet). As an early-stage platform, we haven't completed SOC 2 certification. It's on the roadmap as we scale, but we won't claim compliance we haven't earned.

The best security posture isn't the one with the most impressive claims on a marketing page. It's the one that's honest about what it does, transparent about what it doesn't, and built to protect your data at every layer that matters.

Why This Matters for Manufacturing SMEs

Large enterprises have dedicated security teams to evaluate vendors, run penetration tests, and negotiate data processing agreements. SME manufacturers usually don't. That means the security burden falls on the platform itself — it needs to be secure by default, not secure after six months of custom configuration.

That's how AWI Analytics is built. Every security layer described in this article is active from the moment you create an account. There's nothing to configure, nothing to enable, and nothing that requires a security specialist to set up. You get encrypted storage, encrypted connections, scoped data isolation, and access controls out of the box.

Your sensor data, maintenance records, and production logs are the foundation of better decisions. Protecting them isn't optional — it's the baseline.

Key Takeaways

  • JWT authentication secures every user session with signed, time-limited tokens and built-in team management.
  • HTTPS/TLS encryption protects all data in transit. No unencrypted requests are accepted. CORS allowlisting prevents unauthorised API access.
  • AES-256 encryption at rest via AWS S3 SSE-S3 means your stored data is encrypted the moment it's written.
  • Organisation-scoped isolation enforced at the query level ensures your data is never visible to other accounts.
  • Managed cloud infrastructure with automated TLS, backups, and redundancy removes the risk of manual misconfiguration.
  • Role-based access controls let you decide exactly who sees what within your team.
  • You control the AI path. Bring your own AI provider (Anthropic, AWS Bedrock, Microsoft) on your enterprise contract; AWI is the orchestration layer, not the model vendor. Every answer has a full audit trail — SQL, retrieved chunks, model output, verified record — and your data is never sold or shared.
  • We're transparent about limitations — no zero trust claims, no SOC 2 claims, no pretending third-party services aren't involved.