Your plant's data, your rules.
A plant lets HawaOS into its compressor room on three conditions: nothing we install can hurt the process, nothing we collect leaves the Kingdom or your control, and everything we do is written down. This page is how we keep all three.
1. The gateway only reads
Nothing in the kit can change a setpoint.
The gateway sits on the station side of your network and reads your compressor controllers over Modbus TCP or OPC UA with read-only register maps; its own sensors are wired in parallel and touch no control loop. It opens no inbound ports. It sends outbound only, over TLS, to HawaOS in the Kingdom, and stores data locally when the link drops so that nothing is lost and nothing is invented.
No control writes in year one is a contractual term, not a setting. Every change to your station is made by a person under a priced work order, logged with who, what, when and the data before and after.
2. Where the data lives
In the Kingdom, from the first byte.
Plant data is stored and processed in a Saudi cloud region operated by a provider registered with the Communications, Space and Technology Commission, with backups in the Kingdom. We classify your data under the Personal Data Protection Law and your own data-classification policy, and we can sign your data-processing terms rather than ask you to sign ours.
Models are trained on aggregated, de-identified data only, and only from customers who have agreed to that in writing. Your station's data is never shown to another customer.
3. Who can see what
You decide, and the log proves it.
You own it
Your plant's data is yours. Export it at any time as CSV or by API; on exit, we delete it within 30 days and confirm in writing.
Roles, not passwords
Access by role: plant manager, energy manager, operator, Arcoma technician, HawaOS engineer. Single sign-on with your directory where you have one; two-factor everywhere.
Every action logged
Who looked at what, who raised which work order, who closed it and on what evidence, kept for the life of the contract and available to your auditors.
Technicians see their job
An Arcoma technician sees the work order, the station and the data that justify it, nothing else about your plant.
4. When the air drops
An alarm that nobody reads is not an alarm.
Alarms go to the people you name, on the channels they use: WhatsApp, SMS, a phone call for the serious ones. Every alarm carries the likely cause and the recommended action, in Arabic or English. If nobody acknowledges within the agreed minutes, the alarm escalates to the next name, then to the Arcoma branch on duty.
The gateway keeps watching when the internet does not: it buffers data and raises local alarms on its own, so a cut cable does not blind the station.
5. Controls and assurance
Designed to the standards your own IT and OT teams use.
HawaOS is designed to the National Cybersecurity Authority's Essential Cybersecurity Controls as they apply to suppliers of critical-infrastructure operators, and to the OT segmentation practices your plant already follows: the gateway lives in its own network zone, talks only to the addresses you allow, and is updated through signed releases you can schedule.
Independent penetration testing of the platform and the gateway is carried out annually, with a summary available to customers under NDA. ISO 27001 certification is on the roadmap; until then, our controls are documented and open to your audit.