Security & data
Your SCADA never leaves your rules.
Process data is sensitive, so here is exactly how it moves, where it sits and what AroIQ does with it. Read-only from your historian. Isolated in your own tenant. On the protocols your IT already approves.
SOC 2 Type II, AroIQ in scope.
Report available under NDA.
Your network
Control systems
No connection
Historian
PI · AVEVA · exports
Your tenant
Staged & cleaned
dedicated storage
Models
reviewed by people
Your teams
Outputs
AroIQ · your stack
The short version
Four answers your IT team will want first.
AroIQ's entire footprint is a data connection to your historian — nothing in the field, nothing on the control network. Everything else follows from that.
SOC 2 Type II
Our controls are independently audited, with the AroIQ platform itself inside the audit boundary. The SOC 2 Type II report is available under NDA. Ask for it before the security session, so your reviewers start from evidence, not a sales deck.
- Report under NDA
- Independently audited
Your IT protocols, not ours
Historian exports, SFTP or historian connectors — whichever your IT approves. Trials typically run on exported history; nothing touches a live feed until you say so. Hosted in North American cloud regions, or in the region your IT prefers.
- Exports
- SFTP
- Historian connectors
Isolated per customer
Each customer's data sits in dedicated storage, with org-scoped tenancy and row-level security in the app. You own your raw process data — we ingest and stage it to run the analysis.
- Dedicated storage
- Row-level security
Read-only, one way
AroIQ reads from the historian. No write-back, no connection to control systems — nothing we run can change a setpoint. Data is encrypted in transit and at rest.
- No write-back
- Encrypted in transit & at rest
How data moves
Historian to record, in five hops.
One direction, every step recorded. Nothing flows back toward the field.
- 01 Your network
Your historian
PI, AVEVA and other SCADA and DCS historians.
- 02 Your network
Export or connector
CSV or Parquet export, SFTP, API or a historian connector — your IT's choice.
- 03 Your tenant
Staged & cleaned
Telemetry codes stripped, gaps filled and self-tested, drift corrected — in your tenant, in dedicated storage.
- 04 Your tenant
Models
Read-only on the staged copy. Reviewed by people — engineers confirm, override or flag; every calculation recorded.
- 05 Your teams
Outputs
The AroIQ dashboard, or raw outputs into your stack: Snowflake, ops centre, work orders.
For your security team
Built for your security review.
A vendor questionnaire is a normal part of the first month. Here is what we bring to it.
Not ready to share data yet? Start with the review. A trial begins after the security session, on an export your IT approves.
- Scope Process history · pressures, temperatures, flows, valve states — plus records you choose to share
- Assurance SOC 2 Type II · report available under NDA
- Identity SSO / SAML · Azure AD / Entra ID
- Tenancy Row-level security · org-scoped, dedicated storage
- Encryption In transit and at rest
- Data flow Read-only, one way · from the historian
- Control systems No connection, no write-back
- Hosting North American cloud regions · or the region your IT prefers
- Availability Public status page · status.arolytics.com
Before any data moves
Bring the questionnaire.
We'll bring the engineers.
Every engagement starts with a technical and security session between your IT and ours — before a single export leaves your network.