Manage thousands of industrial gateways as one device

Adding a new device needs no technical training.

• AvailableQR code from the boxScan it with a phone or type the serial number and the claim code. The code works once and wrong attempts are limited.
• AvailableBatch import with CSVHundreds of devices at once, with a report row by row and a file of the failed ones.
• AvailableFirst-steps assistantLeads a new client from the first added device to a working unit: network, configuration, first application.
• AvailableActivation queueFor every added device: waiting for first connection, connected, or error with the reason.
• AvailableSelf-activation at first power-upThe device creates a key, gets a certificate and becomes active by itself.

• AvailableFleet list with filtersBy state, site, group, hardware revision and firmware version.
• AvailableReady viewsFor example "Offline for more than 24 hours" and "Old firmware".
• AvailableFleet health at a glanceTotal, online, offline, with an alarm.
• AvailableDevice detailIdentity, state, versions, last connection, technical telemetry, history of commands and events.
• AvailableOnline and offline status within seconds
• AvailableLive messages from the deviceYou see what the device sends to the platform at the moment it arrives.
• AvailableA team in syncWhen a colleague changes something, your screen updates by itself.
• SoonOwn names and tags for devices

Technical telemetry is about the health of the device itself: uptime, memory, versions, connectivity. It is not your production data.

• AvailableSub-organisationsCompanies, cities and sites in a tree of any depth. Every device is in exactly one site.
• AvailableDevice groupsIndependent of the structure: by production line, type of facility or any attribute.
• AvailableInheritance downwardsConfiguration, applications and rights set for a company apply to all its sites, unless a site changes them.
• AvailableThe most specific winsA device setting beats the group, the group beats the site, the site beats the organisation. Conflicts are shown, not settled silently.
• AvailableSwitching between organisationsFor people who work for several.

• AvailableConfiguration as desired stateIt is applied, stored and survives a restart. A device that was offline gets it at the next connection.
• AvailableFour levelsOrganisation, site, group and device.
• AvailableForm for the device parametersWiFi, Bluetooth LE, Ethernet, LTE modem, telemetry, logs, NTP, power.
• AvailableValidation before sendingAn invalid configuration is refused in the console before it reaches a device.
• AvailableVersions and rollbackEvery change is a version with an author and a date. One action returns to a previous one.
• AvailableProtected secretsPasswords and tokens are stored encrypted and are never shown back in the console.

GridBit applications are WebAssembly packages. They run in an isolated environment on the device and reach only what they are allowed to.

• AvailableDeclarative applicationsYou set which applications and versions an organisation, site, group or device must have. The device installs, updates and removes by itself.
• AvailableDesired against actualMissing, different version, not wanted, in sync.
• AvailableLocks and application parameters per level
• AvailableProtection from switching itself offThe management agent and the system applications cannot be removed by mistake, even with a wrong list. The device refuses.
• AvailablePrivate registry of the organisationYou upload your own applications from the console. Before the upload you see what the device will get: name, version, permissions, memory, state of the signature.
• AvailableVersionsDraft, published, deprecated. Groups can be pinned to one version.
• AvailableCatalogue of system packages from GridBitThe mandatory ones arrive automatically. The optional ones are switched on by the owner or an administrator, per organisation, site or device.
• AvailableCompatibility with the kernelEvery application declares the firmware versions it works with.
• SoonDependencies between packagesAn application that needs a library or a driver gets them automatically.

• AvailableKernel releasesEvery release is checked at upload (size, order of versions) and needs explicit approval before it goes out.
• AvailableAn image encrypted for each device
• AvailableResumable downloadA broken link does not restart the download.
• AvailableHardware revision checkAn image for another revision does not reach the device.
• AvailableCompatibility check with the applicationsAn update that would stop an installed application is refused, unless you accept it knowingly.
• AvailableResult reportSuccessful, failed and rolled-back devices, with the reason.
• SoonSafe update through recoveryA separate recovery partition writes the new kernel. If something goes wrong the device stays in recovery and reports, instead of turning into a brick.
• SoonMandatory secure boot signature check at upload
• SoonStable and beta channels
• SoonYour maintenance windowYou set when devices may restart, per organisation, site or device. Outside the window there is no restart.
• SoonPostponing with a ceilingYou can postpone an update. Security releases keep a hard deadline, so that the fleet does not stay unprotected.

• AvailableStagesFor example 10 %, 50 %, 100 %, with a pause between them.
• AvailableChoice of scopeOrganisation, region, hardware revision, firmware version or an explicit list of devices.
• AvailableAutomatic stop on errorsHealth is checked after every stage.
• AvailableAutomatic rollbackWhen the rollout stops, the affected devices return to the previous version. If the return fails, you get an alarm.
• AvailableResilienceThe rollout continues from where it stopped, even after a restart of the service.
• AvailableControl from the consolePause, resume, abort.
• AvailablePlanned startIn a set time window.
• SoonThe time zone of each device is taken into account

• AvailableCommands to a deviceRestart, diagnostics, start and stop of an application, list of processes.
• AvailableA confirmation for every commandYou see whether it was executed, refused or expired without an answer. Nothing disappears silently.
• AvailableHistory of commandsWhat, by whom, when and with what result.
• AvailableGroup commandsTo a group or a filter, with progress per device, a summary and a retry for the failed ones only.

• AvailableA terminal to the device in the browser
• AvailableNo open portsThe device dials out by itself, so access works behind CGNAT, a corporate firewall and a mobile LTE operator.
• AvailableAdministrators onlyUsers with limited rights cannot open a session. Every session needs a reason.
• AvailableSwitch-off per organisation or siteFor critical sites remote access can be forbidden completely. The server enforces the ban, it does not just hide a button.
• AvailableAccess for GridBit only with your permissionA request, your approval for up to 7 days, automatic expiry and an end at any time. Everything is in the audit log.
• AvailableSession recordingThe input and output of every session are recorded and kept for 90 days.
• SoonViewing and downloading the recordings from the console

• AvailableAlarm rulesBy metric, condition, threshold and time window, with a severity, for the whole organisation or one device. The alarm closes by itself when the value returns to normal.
• AvailableA webhook for every ruleWith retries on failure.
• AvailableSlack and Microsoft TeamsThrough a webhook, with a test message.
• SoonSlack and Teams connected in a few clicks
• AvailableE-mail notificationsA grouped digest of the alarms, rollout results, invitations. Every user chooses what to receive.
• AvailableMutingFor a period, a device or a group during planned work.

• AvailableTransfer of ownershipThe configuration, applications and data of the previous owner are cleared. Both sides see a trace in the audit.
• AvailableReplacement of a faulty device (RMA)The new unit inherits the site and the applications of the old one. The old one is revoked.
• AvailableRetirementThe certificate is revoked, the history stays readable.
• AvailableLost or stolenThe device is refused by the network and, if you choose, wipes itself at the next connection. If it is found, the state comes back.
• AvailableRevocationA revoked device cannot connect.
• SoonData retention policy per organisation

• AvailableSelf-service registrationWith confirmation by e-mail. The organisation is created automatically.
• AvailableInvitations by e-mail with a roleThe invitation expires. Nobody can invite someone with more rights than their own.
• AvailableRolesOwner, administrator, operator, viewer. The viewer cannot change anything.
• AvailableRights scoped to a sub-organisationInherited down the tree.
• SoonRights scoped to a group
• AvailableTwo-factor authentication (TOTP)With backup codes. The owner can make it mandatory for the whole organisation.
• AvailableSign-in with a corporate account (OpenID Connect)For example Microsoft Entra ID, Google or Okta, with automatic creation of the user and a role from the group in the identity provider.
• SoonSAML
• AvailableSign-in protectionProgressive delay and a temporary block on guessing attempts.
• AvailableSign-out from all devicesWith one action.

• AvailableFull audit logEvery action that changes something or reads sensitive data: who, when, from which IP address, on what, with what result. Refused attempts are recorded too.
• AvailableImmutableThe records cannot be edited or deleted, even by the application. The database enforces it.
• AvailableThe actions of GridBit are visible to you
• AvailableFiltering and CSV exportFor the owner of the organisation.
• SoonCSV export for administrators
• AvailableVersioned acceptance of the termsThe console records which version of the terms and of the data processing agreement was accepted, by whom and when. A new version asks for a new acceptance.
• AvailableDeletion of the organisation (GDPR)With a grace period.

One chain of trust for everything that runs on the device: applications, drivers, kernel, recovery.

• SoonOwn signing key of the organisationRegistered from the console. The client signs its own unprivileged applications.
• SoonPrivileged code signed by GridBit onlyDrivers, system applications and the kernel, with explicit human approval that is checked outside the platform.
• SoonGridBit keys in a hardware security moduleIn a data centre in the EU.
• SoonKey revocation for the whole organisation with one signatureA revoked key stays revoked on the device. Restoring trust needs the approval of two different people.
• SoonOffline policyThe organisation decides how long devices run its applications without a link to the platform. The firmware guarantees at least 72 hours, so even a wrong setting does not stop a site over a weekend.
• SoonCommand line toolWith the same rights and the same audit as the console.
• SoonService accounts with API tokensScoped to an organisation, with rotation and revocation.