Trust and compliance
Certified, and built to pass a vendor review.
Industrial data is operational and often commercially sensitive. Here are the certificates, the controls behind them and the documents a security or procurement review will ask for.
- Certified
- ISO 27001:2022 and ISO 9001:2015, valid until 21 April 2027
- Deployment
- On-premises, private cloud or air-gapped, your infrastructure, your control
- Data protection
- Privacy notice and data subject rights under GDPR and KVKK, published on this site
- For procurement
- Public certificate PDFs, plus a deployment and security brief on request
Certificates
Independently certified management systems.
Issued to Proxus Yazılım Hizmetleri İthalat İhracat Sanayi ve Ticaret Limited Şirketi. Both certificates are public: download them, or verify them with the certification body.
-
Information Security Management System
ISO 27001:2022
- Certificate number
- 2026/ISMS/002377
- Initial certification
- 22 April 2026
- Valid until
- 21 April 2027
- Certification body
- IQR International Certification Services LLC
-
Quality Management System
ISO 9001:2015
- Certificate number
- QMS-015534
- Initial certification
- 22 April 2026
- Valid until
- 21 April 2027
- Certification body
- IQR International Certification Services LLC
Certified scope
Software development and delivery activities.
- Computer programming activities
- System, database, network and web-based software development
- Designing, coding and testing custom software solutions tailored to customer needs
- Development and sales activities for desktop and mobile applications
Controls
What the certificate means in the product.
A management system certificate covers how we work. These are the controls a reviewer will find in the platform itself.
-
Encrypted transport
TLS on every link: edge to hub (verified against the platform CA), the hub’s own services, the built-in MQTT broker (TLS on 8883; 1883 stays open only for devices that cannot use TLS, and can be closed) and outbound integrations, where server certificates are always verified. Credentials are held in configuration your administrators control, not in a vendor service.
-
Role-based access control
Users, roles and object-level permissions across configuration, live data, dashboards and API access, including permissions on namespace paths.
-
Certificate management
One built-in certificate authority in the Certificate Store issues and renews the platform’s certificates, or a corporate CA can be used instead. OPC UA trust is managed there too, inside the product rather than on individual machines.
-
Recorded configuration changes
Every configuration change is recorded in the audit trail, and pipelines keep revisions you can compare.
-
Operational transparency
Health and delivery status are visible in the product. Detailed evidence (stack traces, paths, payloads) stays in support bundles, not in customer-facing logs.
-
No outbound dependency
The platform collects, models, stores and delivers entirely inside your network. Air-gapped deployments need no internet access to function: images are loaded offline, the licence is checked against a signature, and Copilot works with a local Ollama model. A cloud AI service needs outbound HTTPS only if you choose one.
For vendor review
What we send, and when.
Ask early. Security questions answered before a pilot cost nothing; the same questions after procurement cost a quarter.
Request documents- Certificate PDFs
- Both ISO certificates are published on this page and can be verified with the issuing body.
- Deployment and security brief
- Topology, transport, credential handling, access model and upgrade path, sent before the first technical call, not after procurement.
- Data processing questions
- What is collected by the platform, where it is stored and how long it is retained, with the retention policy set by you.
- Privacy notice
- How this website processes personal data, the services that process it for us and how to exercise your rights under GDPR and KVKK.
- Company record
- Legal entity, address and registration details for supplier onboarding.
- Release history
- Every version is written up with a date, so "actively maintained" is something you can check rather than take on faith.
- Reporting a vulnerability
- Write to hello@proxus.io about a security issue in Proxus or this website. The same address is published in this site’s /.well-known/security.txt.
- Anything else
- Write to hello@proxus.io with the questionnaire you have to fill in. It is quicker than guessing what your process needs.
Next step
Bring your security review to the first call.
Send us the questionnaire before the technical session. We would rather answer it up front than discover a blocker after a successful pilot.
- 01
Scoping call
Equipment, protocols, sites and the systems the data has to reach.
- 02
Technical walkthrough
A working demo against a scenario that resembles your plant, not a generic tour.
- 03
Pilot plan
A defined first line or site, with the deployment and security questions answered up front.
- 04
Roll-out
The same templates bring the next lines and sites online.