Industrial IQ Security and Data Handling Brief

Visual control matrix

Security and procurement reviewers should see the trust boundary at a glance.

Icons are paired with visible labels and status tags. They summarize the control posture without replacing the detailed policy text below.

Open Security Brief

Live

No ERP write-back

Diagnostics do not autonomously change SAP, Maximo, Oracle, EAM, CMMS, procurement, or inventory systems.

Live

Read-only workflow

Industrial IQ evaluates exported operational data and produces review evidence before any buyer-controlled remediation.

Live

Source-file purge

Uploaded source files are used to generate report packs and are purged after report generation according to disclosed handling boundaries.

Live

Human review

Confidence tiers and review queues separate evidence-ready findings from owner-review candidates.

Live

Confidence tiers

Findings carry confidence context so buyers can distinguish strong evidence from review-required signals.

Live

Audit metadata

Open Findings, report ownership, continuity metadata, and audit events support governance where required.

Published

DPA / SLA path

DPA, engagement SLA, security overview, and procurement review language are available for buyer review.

Roadmap

SOC 2 boundary

AI2COE does not claim SOC 2 Type II certification; audit maturity remains a roadmap item until completed.

Security posture summary

Pilot-ready diagnostic controls with explicit enterprise boundaries.

Industrial IQ is designed for read-only diagnostic evaluation. The first enterprise step is exported operational data, not production integration or autonomous remediation. Enterprise production controls, data residency, certification posture, and procurement terms require customer-specific review.

Retention position: Uploaded source files are processed to generate the diagnostic report pack and then purged. Summary metrics, Open Findings, report ownership, quota usage, feedback, and audit metadata may be retained for governance.

Diagnostic data flow

Buyer source systems to owner-reviewed actions.

Buyer source systemsERP / EAM / CMMS / procurement / inventory

Exported fileCSV or workbook controlled by buyer

Industrial IQ uploadGoverned diagnostic path

Diagnostic processingMapped fields, evidence, confidence

Executive reportScore, assumptions, limitations, actions

Action trackerOwner review before operational action

No write-backBlocked path to ERP/EAM/CMMS changes

Security control summary

What enterprise reviewers should inspect.

Control area	Current posture	Buyer value	Status
No ERP write-back	Industrial IQ starts from exported data and does not change SAP, Maximo, Oracle, EAM, CMMS, procurement, or inventory systems.	Reduces production-system change risk during diagnostic review.	Implemented
Export-first diagnostics	Buyers can begin with CSV/workbook exports rather than production integration.	Allows low-risk pilot evaluation before platform commitment.	Implemented
Human review	Findings are evidence for accountable owners to accept, reject, defer, or escalate.	Prevents uncontrolled operational action.	Implemented
Source-backed evidence	Findings include mapped fields, reason codes, source references, confidence, and report context.	Supports finance, operations, procurement, maintenance, and audit review.	Implemented
Access control	Protected workflows require authenticated account context; report ownership and access events are tracked.	Supports reviewer accountability and report control.	Implemented / review per engagement
Report ownership	Reports are tied to generating user and business context where applicable.	Clarifies who owns diagnostic evidence and follow-up.	Implemented
Source-file purge	Uploaded source files are processed to generate the diagnostic report pack and then purged.	Reduces standing source-file retention.	Implemented where diagnostic upload path applies
DPA	DPA language is available for diagnostic engagements and customer-specific review.	Supports legal and procurement due diligence.	Available during buyer review
SLA	Engagement SLA language is published for scoped diagnostic delivery.	Supports procurement and finance review.	Published
Audit trail / action tracker	Open Findings, action status, ownership, quota usage, feedback, and audit metadata may be retained for governance.	Supports report ownership, score history, and review traceability.	Implemented / evolving
SOC 2 roadmap	AI2COE is not claiming SOC 2 Type II certification unless and until an audit is completed.	Keeps enterprise security posture honest.	Roadmap / not yet certified
Cloud hardening	Production hardening, monitoring, backups, and customer-specific security review are evaluated by engagement scope.	Supports enterprise readiness without overclaiming maturity.	Roadmap / customer review

Buyer responsibilities

Use the governed upload path and keep private data out of general forms.

Diagnostic uploads should use the Industrial IQ upload workflow or scoped pilot process. General inquiry forms and chat should not receive private operational data. Buyers remain responsible for export approval, internal classification, and reviewer assignment.

Current maturity status

Pilot-readyFounder-led diagnostics and public trust documentation are available.

RoadmapSOC 2 Type II, expanded monitoring, deployment hardening, and customer-specific reviews remain roadmap or engagement-specific items.

BoundaryCertification, penetration-test, and production-readiness claims are published only when documented.

Security FAQ

Questions CISO, legal, procurement, and CIO teams ask first.

Does AI2COE connect directly to ERP?

The low-risk diagnostic path starts from exported operational data. Customer-specific integration requirements, if any, require separate enterprise review.

Does Industrial IQ write back to ERP?

No. Industrial IQ does not perform ERP write-back, autonomous remediation, blind merge, automatic deletion, or uncontrolled master-data change.

What happens to uploaded files?

Uploaded source files are processed to generate the diagnostic report pack and then purged. Summary metrics, Open Findings, report ownership, quota usage, feedback, and audit metadata may be retained for governance.

Who reviews findings?

Findings are routed to human review. Accountable owners approve, reject, defer, or escalate findings before any operational action is considered.

Can findings be exported?

Sample and engagement-specific outputs may include reports, evidence tables, action queues, and exported artifacts depending on plan and scope.

Can we run a pilot without production integration?

Yes. The founder-led pilot is designed to begin with exported CSV/workbook data and no production-system write-back.

Can our CISO review the controls?

Yes. Use this security brief, Data Retention, DPA, SLA, and Trust Center pages as the first review pack. Customer-specific security review can be addressed during engagement scoping.

What certifications are currently available?

AI2COE does not claim SOC 2 Type II certification unless certified. Current maturity is described as pilot-ready with a security roadmap and buyer-specific review boundaries.

Evaluation assets

Proof, templates, trust, and pilot paths for serious buyers.

Enterprise evaluation asset

View Sample Reports

Inspect evidence, score, report, and action outputs before upload.

Enterprise evaluation asset

Download Buyer Evaluation Guide

Use the buyer committee, technical, procurement, and security review checklist.

Enterprise evaluation asset

Download Data Templates

Prepare starter CSV structures for all eight Industrial IQ engines.

Enterprise evaluation asset

View Security Brief

Review hosting, access, retention, DPA, SLA, SOC 2 roadmap, and no-write-back controls.

Enterprise evaluation asset

Request Founder-Led Pilot

Scope a low-risk diagnostic engagement before transformation spend.

Trust review lens

Use this page to validate the operating boundary before data is uploaded.

Trust review gives security, procurement, legal, IT, and governance reviewers clear language before a diagnostic starts.

Best-fit reader

CISO, CIO, procurement, legal, risk, security, data governance, and enterprise architecture teams.

Evidence to prepare

Hosting, access, data handling, retention, source-file purge, no ERP write-back, human review, DPA, SLA, and buyer-security review language.

Output to expect

A buyer-security review path that clarifies what Industrial IQ does, what it does not do, and what can be reviewed during procurement.

Trust boundary

Read-only diagnostics, no ERP write-back, source-file purge after report generation, and human review before action.

Security brief Data retention No ERP write-back Human review