OT and security-review FAQ
Straight answers to the questions OT and security reviewers ask first. If yours isn’t here, ask us.
Do we have to open our network to the internet?
No. The site connector makes an outbound connection; nothing needs to accept inbound traffic from the internet.
Does HartBeat replace our configuration software?
No. Your technicians keep using it through a secure, recorded path.
What exactly gets recorded?
Who, when, which site, gateway, and instrument, which session, which HART command and category, the policy decision and reason, and whether the command was carried out, all signed and chained.
Can the audit record be altered?
Any edit, deletion, or reordering is detectable, because every record is signed and linked to the one before it.
Can HartBeat block a command?
HartBeat evaluates every command against your access policy and permanently records the decision and outcome. Enforcing mode, where out-of-policy commands are withheld, is on our roadmap.
Is our data separated from other customers’?
Yes. Every organization is strictly isolated, enforced in more than one layer.
Can we give a vendor access?
Yes. Give them a contractor account: they can work in remote sessions, and everything they do is recorded under their name.
Can we export our records?
Yes. Administrators and auditors can export the audit trail at any time.
How long do you keep our records?
For as long as you’re a customer. If you leave, you get your records first; we hold them for a 180-day closing period and then delete them permanently.
What happens if a payment fails?
The organization is suspended with all data intact and comes back as it was once resolved.
Is HartBeat SOC 2 or IEC 62443 certified?
HartBeat is designed toward SOC 2 controls and built with IEC 62443 and NIST SP 800-82 principles in mind. We don’t claim certifications we don’t hold.
What do we need for a trial?
See the Trial Readiness Checklist. Contact sales and we will scope it with you.
Need more depth?
Read the security overview and the architecture overview, or go deeper under NDA.
Set up a trial with our team.
Contact sales to set up a trial: for distributed operators, service teams, and instrumentation groups ready to evaluate governed remote HART access.