Features · 06 / 06

Security

Keep the data with you and decide what leaves: network, updates, access, licence.

« What leaves my premises, and who can get in? »

What it changes

You produce without a network
DMEOS® runs in your workshop and keeps producing when the connection drops.
Your data stays with you
Nothing leaves without your decision, and Farm-3D has no access to your production.
Only your workstations get in
DMEOS® only opens on the workstations you have listed, and sensitive actions need a name and a personal code (PIN).

Works offline
No permanent network dependency.
Network posture per channel
Sealed, supervised or connected: every outbound path is decided and provable.
Authorised workstations
Only the workstations on your network that you list can open DMEOS®.
Encrypted extranet
Hosted in France, to supervise remotely.

Offline updates
Verified hash, USB key, name and PIN required. Nothing restarts on its own.
A licence that never cuts off
A unit in service is never stopped by a licence check.

Security, in detail

Each line states what the product does today and can be checked on the delivered unit.

Encrypted disk on every delivered unit
Linux units: LUKS2, key sealed in the TPM 2.0 chip. Windows units: BitLocker with a TPM protector.
Pre-delivery check
A unit with an unencrypted disk or no recovery key is refused. On a PC, so is a key not bound to the chip, or Secure Boot switched off.
Part files under a second envelope
On top of the disk, an AES-256-GCM envelope under a key generated on the unit and sealed by its chip on a PC. That key exists nowhere else.
Recovery key
Shown once, copied on paper and typed back before installation ends. Never written to disk, to a log or to the network.
State measured and shown
Encryption is measured by the unit itself; an unencrypted disk lights a red alert on every screen.
Mini edition
Encrypted data volume; key sealed in a TPM module.

Three profiles, set at delivery
Sealed: nothing leaves. Supervised: presence only. Connected: presence and updates. The profile comes from a document signed by Farm-3D and bound to the unit's serial number.
Enforced by the system, not only by the application
The profile drives a default-deny outbound firewall (nftables on Linux (AlmaLinux), Windows Firewall). Only the site's local network stays reachable.
System services switched off
Outside the Connected profile: Windows Update, telemetry, SmartScreen, Defender cloud lookups (Defender stays active), Edge and WebView2 updaters, dnf and apt timers.
Proof on screen
Settings shows whether the firewall is in force, how many outbound attempts were refused and the latest blocked destinations.
Only Farm-3D can relax the profile
The operator can always make it stricter. Relaxing it requires an authorisation signed by Farm-3D, bound to the unit and applied offline.
No inbound access for Farm-3D
No SSH key, no remote control. Support goes through a diagnostic bundle, within a window of 24 h at most opened by the operator.
Telemetry capped by the profile
None when Sealed. Whatever the profile, never any production data in the presence signal.

Every package is signed
OpenPGP Ed25519 signature, checked against a public key compiled into the software, before the package's content is opened.
Signature mandatory
Unsigned, signed by an unknown key, or SHA-256 mismatch: refused. No setting bypasses it.
Never a rollback
A version older than or equal to the installed one is refused, down to the privileged installer.
USB key for offline units
FAT32 only. Nothing on the key is executed: it only brings data, checked before any use.
Name and PIN for every install from a key
Always required, whatever the unit's settings; the author is written to the journal before the install begins.
Foreign key: alarm
An unknown storage key or a tampered package sets off an audible alarm and an on-screen banner.
System patches on the same key
Linux units: operating-system security patches arrive offline, under Farm-3D's signature and the vendor's.
Delivered units: production key onlysoon
Trust limited to Farm-3D's production key, which signs on an offline station, never in the cloud or in continuous integration.
Backup signing key and revocationsoon
Replace a signing key by USB key, with no site visit.

Licence bound to the hardware
Signed by Farm-3D, verified offline on the unit, bound to its hardware fingerprint, TPM chip included on a PC.
A copy is useless
A copied disk or a unit cloned onto other hardware does not install.
Never stops a running unit
No licence check stops a unit in service or a print in progress; a fault is shown and repaired on site.
Two keys, two uses
The key that signs licences does not sign packages: issuing a licence cannot produce an update.

Append-only journal
Enforced by the database: the application's account can neither modify nor delete an event.
Name and PIN, always, for sensitive gestures
Changing the network profile, authorising a workstation, opening a diagnostic window, installing from a key, re-running a print.
PIN access, by role
Three roles: operator, manager, referent. Each person signs in with a personal code; administering the unit is reserved to the referent.
Clearance levels beyond rolessoon
Operator levels, earned through training, on top of the three roles.
An unsigned gesture is recorded as such
Done without a PIN, it is recorded under the workstation's name and marked unsigned, never attributed to a person.
A missing reading is flagged
If a sensor or a machine does not answer, the screen reads « not available » instead of a number.
Print report fingerprint
The document's SHA-256 fingerprint is computed and kept when it is generated.
Diagnostics traced
Every opening or closing of a diagnostic window is written to the journal: who, when, until when.