Security
This is what the platform under Twinton enforces, and what we promise about the data a twin collects on your floor.
A signed, attenuating capability chain rooted at a key your site controls is the only authorization mechanism. The node that performs an action verifies the chain before acting. A capability can be narrowed when it is passed on and revoked at once. There are no shared passwords and no accounts to phish.
Each machine's control API binds to loopback by default, and every request that changes state carries a token derived from the node's own identity. Read-only queries stay separate from anything that moves data or money.
A twin can run on hardware you own inside your plant. Where hosting is needed, the recommended region is Hong Kong, chosen because mainland hosting requires an ICP filing that needs a Chinese entity. Source code for the commercial products is private.
Collection is scoped to work and material flow: which station a load reached and when. The design target is that no personal information is collected at all, which keeps a flow-only twin outside the cross-border data regime entirely.
No individual productivity scoring. No face recognition. No green light painted on a machine nobody measured. Access is restricted to named roles and retention is agreed in the pilot terms.
Every message on the factory agent network is signed with an Ed25519 key. Where the hub holds a key for a factory with no software, every receipt says so, and the network's own documentation states plainly what the operator can read.
Thirty minutes on a call, then a walk of one area of your floor with the twin on a laptop. No preparation needed.