Industrial IQ Security and Data Handling Brief

Security posture summary

Pilot-ready diagnostic controls with explicit enterprise boundaries.

Industrial IQ is designed for read-only diagnostic evaluation. The first enterprise step is exported operational data, not production integration or autonomous remediation. Enterprise production controls, data residency, certification posture, and procurement terms require customer-specific review.

Retention position: Uploaded source files are processed to generate the diagnostic report pack and then purged. Summary metrics, Open Findings, report ownership, quota usage, feedback, and audit metadata may be retained for governance.

Diagnostic data flow

Buyer source systems to owner-reviewed actions.

Buyer source systemsERP / EAM / CMMS / procurement / inventory

Exported fileCSV or workbook controlled by buyer

Industrial IQ uploadGoverned diagnostic path

Diagnostic processingMapped fields, evidence, confidence

Executive reportScore, assumptions, limitations, actions

Action trackerOwner review before operational action

No write-backBlocked path to ERP/EAM/CMMS changes

Security control summary

What enterprise reviewers should inspect.

Control area	Current posture	Buyer value	Status
No ERP write-back	Industrial IQ starts from exported data and does not change SAP, Maximo, Oracle, EAM, CMMS, procurement, or inventory systems.	Reduces production-system change risk during diagnostic review.	Implemented
Export-first diagnostics	Buyers can begin with CSV/workbook exports rather than production integration.	Allows low-risk pilot evaluation before platform commitment.	Implemented
Human review	Findings are evidence for accountable owners to accept, reject, defer, or escalate.	Prevents uncontrolled operational action.	Implemented
Source-backed evidence	Findings include mapped fields, reason codes, source references, confidence, and report context.	Supports finance, operations, procurement, maintenance, and audit review.	Implemented
Access control	Protected workflows require authenticated account context; report ownership and access events are tracked.	Supports reviewer accountability and report control.	Implemented / review per engagement
Report ownership	Reports are tied to generating user and business context where applicable.	Clarifies who owns diagnostic evidence and follow-up.	Implemented
Source-file purge	Uploaded source files are processed to generate the diagnostic report pack and then purged.	Reduces standing source-file retention.	Implemented where diagnostic upload path applies
DPA	DPA language is available for diagnostic engagements and customer-specific review.	Supports legal and procurement due diligence.	Available during buyer review
SLA	Engagement SLA language is published for scoped diagnostic delivery.	Supports procurement and finance review.	Published
Audit trail / action tracker	Open Findings, action status, ownership, quota usage, feedback, and audit metadata may be retained for governance.	Supports report ownership, score history, and review traceability.	Implemented / evolving
SOC 2 roadmap	AI2COE is not claiming SOC 2 Type II certification unless and until an audit is completed.	Keeps enterprise security posture honest.	Roadmap / not yet certified
Cloud hardening	Production hardening, monitoring, backups, and customer-specific security review are evaluated by engagement scope.	Supports enterprise readiness without overclaiming maturity.	Roadmap / customer review

Buyer responsibilities

Use the governed upload path and keep private data out of general forms.

Diagnostic uploads should use the Industrial IQ upload workflow or scoped pilot process. General inquiry forms and chat should not receive private operational data. Buyers remain responsible for export approval, internal classification, and reviewer assignment.

Current maturity status

Pilot-readyFounder-led diagnostics and public trust documentation are available.

RoadmapSOC 2 Type II, expanded monitoring, deployment hardening, and customer-specific reviews remain roadmap or engagement-specific items.

BoundaryCertification, penetration-test, and production-readiness claims are published only when documented.

Security FAQ

Questions CISO, legal, procurement, and CIO teams ask first.

Does AI2COE connect directly to ERP?

The low-risk diagnostic path starts from exported operational data. Customer-specific integration requirements, if any, require separate enterprise review.

Does Industrial IQ write back to ERP?

No. Industrial IQ does not perform ERP write-back, autonomous remediation, blind merge, automatic deletion, or uncontrolled master-data change.

What happens to uploaded files?

Uploaded source files are processed to generate the diagnostic report pack and then purged. Summary metrics, Open Findings, report ownership, quota usage, feedback, and audit metadata may be retained for governance.

Who reviews findings?

Findings are routed to human review. Accountable owners approve, reject, defer, or escalate findings before any operational action is considered.

Can findings be exported?

Sample and engagement-specific outputs may include reports, evidence tables, action queues, and exported artifacts depending on plan and scope.

Can we run a pilot without production integration?

Yes. The founder-led pilot is designed to begin with exported CSV/workbook data and no production-system write-back.

Can our CISO review the controls?

Yes. Use this security brief, Data Retention, DPA, SLA, and Trust Center pages as the first review pack. Customer-specific security review can be addressed during engagement scoping.

What certifications are currently available?

AI2COE does not claim SOC 2 Type II certification unless certified. Current maturity is described as pilot-ready with a security roadmap and buyer-specific review boundaries.

Evaluation assets

Proof, templates, trust, and pilot paths for serious buyers.

Enterprise evaluation asset

Industrial IQ Security and Data Handling Brief.

Trust and governance guide