Architecture

The shape of the system

Four things feed the platform, and they are deliberately kept distinct all the way through:

1. Field devices — RTUs, PLCs and flow computers, reached directly over Modbus, DNP3 or OPC UA, or via an edge gateway publishing MQTT with Sparkplug B.
2. Field people — pumpers recording gauges, hauls and corrections from a phone, including with no connectivity.
3. The production accounting system of record — read over a least-privilege, SELECT-only connection.
4. Reference data — strapping tables, lab results, tank configuration and the asset model.

Inputs 1 and 2 are both measurements. They arrive through different paths and carry different provenance, but everything downstream treats them as the same kind of fact. That convergence is the core design decision.

Input 3 is never written to.

Data stores

Three stores, separated on purpose.

Operational data holds the asset model, telemetry history, alarms, control audit entries, captured field data and derived volumes.

Identity lives in a separate database. It holds accounts, sessions and grants. No query joins across identity and operational data — the separation is structural rather than a convention the application is trusted to respect.

Your system of record stays where it is, under your control, read-only.

Sessions and authorization

Sessions are server-side. The browser holds only an opaque token, and the server re-establishes who the caller is on every request. Revoking an account takes effect on the next request rather than whenever a cached claim would have expired.

Authorization is evaluated per request against the caller’s company grants. Visibility and control authority are separate grants; see control.

Failure behaviour

The platform fails closed. If a source connection, schema, permission or query fails, the request returns an error describing what failed.

It does not fall back to sample data, does not relabel a stale value as current, and does not interpolate across a gap to keep a chart continuous. This is a deliberate trade — some surfaces will show holes — and those holes are information. See data quality.

Deployment options

Cloud

Hosted. Operators sign in; there is no infrastructure to run. The platform reaches your system of record and your field connectivity over connections you authorize.

Customer-hosted

The platform runs inside your network. Operational data does not leave it.

Both options run the same build and the same feature set. The deployment choice does not fork what the product can do, and it does not put capability behind a higher tier.

Where the edge gateway sits

In both options, an edge gateway is a site-local component. It holds the chatty protocol conversation with local devices and publishes only changes upstream, which is what makes metered cellular practical. If the uplink drops, the gateway still holds the local connection, and the outage is a known state rather than missing data.

What crosses which boundary

Path	Direction	Contents
Field devices ↔ platform	both	Telemetry in; supervisory commands out, where authorized
Phone ↔ platform	both	Queued gauges, hauls, corrections up; scoped asset list down
System of record → platform	one way	Approved fields, SELECT only
Platform → system of record	none	Nothing. There is no write path to your books