Security Overview — for your IT / OT review

The posture in one paragraph

Daritas analyses exported artifacts — PLC project exports, tag and alarm lists, manuals, drawings — that you choose to hand over. The assessment requires no connection to your installation, no agent on your network, and no write access to anything. The deliverable you receive is a self-contained file that runs no code and phones nowhere. Where later product stages read from the installation, they are read-only, outbound-only, and designed so that your tooling — not ours — enforces what leaves. Production control stays in your PLC/SCADA stack; Daritas is control-adjacent by principle, never control-authoritative.

What we receive, and what we never ask for

We receive (you select and export; nothing is fetched): PLC project exports, tag/alarm lists, HMI exports, manuals, electrical drawings, maintenance notes.

We never ask for: network credentials, remote access, VPN into your site, installation of software inside your network, or live connectivity of any kind for the assessment. A request from anyone claiming to be Daritas for any such credentials should be treated as fraudulent.

Every received file is SHA-256 hashed on intake; the hashes are printed in the report’s source inventory, so your team can verify that what we analysed is exactly what you sent — unmodified.

Where your data lives and who touches it

What the deliverable can do on your machines: nothing

The report is engineered to be inert:

• •Zero scripts. The HTML report contains no JavaScript, no external fonts, no CSS from a CDN, no images fetched from anywhere. An automated test rejects the build if any URL appears in the artifact — strict enough that even an SVG XML namespace attribute was removed.
• •No phone-home, by construction. Open it air-gapped forever; it cannot tell us, and cannot tell anyone.
• •Diagrams are pre-rendered SVG, not runtime-rendered by a library.
• •Everything you own is open format: Markdown, HTML, JSON, JSONL, SVG — readable without Daritas, inspectable line by line by your own security team.

Site connectivity: none — and the design for “later”, if you choose it

The assessment product needs no connectivity, ever. If, in later lifecycle stages, you opt into runtime evidence (confirming recovered behaviour against the running system), the design assumes your network trusts nobody, including us:

• •Outbound-only from your site. Nothing connects in. A snapshot is produced by tooling on your side and pushed (or physically carried) out.
• •Your firewall is a reader of our schema. Requests and responses use closed enums and bounded identifier charsets — there is no free-text field a compromised system could exfiltrate through, and a middlebox can validate every packet against the published structure.
• •Signed and replay-proof. Requests carry ed25519 signatures over a canonical serialisation, plus nonce and expiry. Email transport authenticates nothing — the signature is what your side verifies.
• •Your allowlist rules. Every signal we may ask about is declared in advance; your single-source-of-truth allowlist is enforced by your tooling, offline, without calling us. You may always downgrade to verdict-only, or refuse — a request names the claim it serves so a refusal can be made on articulable grounds.
• •Verification without egress. The snapshot validator runs in a browser with no backend — a file can be checked without leaving your machine.

The portal (when you use it)

• •Authentication and role-based access; row-level security on every customer table — customers see their organisation’s data only, enforced in the database, not in application code alone.
• •Server-side authorization on every privileged action — nothing trusts the client.
• •Rate limiting, structured error monitoring, and signed one-click tokens for email actions.
• •Account offboarding distinguishes revoke (reversible; everything attributed to the person remains) from erase (GDPR Article 17; personal data pseudonymised where deletion would destroy an audit trail — a sign-off never points at nothing).

Standards orientation — alignment, not certification

We build against the grain of ISA/IEC 62443 (zones and conduits; nothing we ship asks you to weaken segmentation), with the EU AI Act risk-based posture and the NIST AI RMF in view for the AI-assisted parts of production. We hold no third-party certifications today (no ISO 27001, no SOC 2) — at our current size we offer transparency and design instead, and this document is written to make your own review possible. Certification is a question of when, driven by customer requirements.

What we deliberately do not do

• •No write access to any of your control systems; no PLC changes; read-only first, always.
• •No AI in any control path — the assessment is analysis of exports, full stop.
• •No publication of our internal model format as an API surface (your data is documented and exportable; the production methodology is not an attack surface we expose).
• •No real customer material in any demo, example, or marketing artifact — every public example is synthetic.

Known limitations — stated, not hidden

• •No external penetration test has been commissioned yet.
• •No formal, document-shaped threat model exists beyond the runtime-snapshot design and the reviewer-network IP threat model; consolidation is planned.
• •Self-service upload controls (per-engagement access scoping, formalised retention defaults) are pending, as marked above.
• •Continuous dependency auditing is not yet wired into CI.

If any of these is a blocker for your engagement, say so — several become scheduled work the moment a customer needs them.

Reporting a concern

Security findings — in the deliverable, the portal, or this document’s claims — via your engagement contact or legal@daritas.com (a dedicated security contact is being established; see also security.txt). We commit to acknowledging reports and to never pursuing good-faith researchers.