Deployment and regions
Hosted in your region, or on your own servers
Hermetry runs as separate deployments in the European Union, the United States and Türkiye. Each organisation lives in one home region. Sites that cannot send data to a cloud can run the same platform on their own servers.
Options
Three ways to run it
They combine: a hosted region or your own servers for the platform, and Edge on the sites that need it.
| Hosted region | On-premises | Edge on site | |
|---|---|---|---|
| What it is | Hermetry operated by Roltek A.Ş. in the EU, the US or Türkiye | The same platform installed in containers on your own Linux servers | Software on licensed gateways and routers that reads field devices and sends their data up one channel |
| Plan | Every plan | Enterprise | Priced on its own, separately from the hardware |
| Where data lives | In your organisation's home region | On your servers, inside your network | Sent up to the platform over one encrypted connection |
| Updates | Run by us | Versioned packages, rolled out when you choose | Signed firmware, rolled out in waves |
| Read more | Regions | On-premises | Edge |
Data residency
What stays in your region
An organisation's devices, profiles, credentials, telemetry, attributes, alarms, dashboards, drawings, rules, flows, settings and audit log live on the platform in its home region. The global directory that routes requests knows only which region and node an organisation is on; it holds no name, address, owner or setting of the organisation.
The residency page
Owners and administrators see the organisation's residency facts in its settings. The facts are signed by the platform's control plane, so the page cannot show facts that were not issued for your node:
- the home region and any residency requirement
- the region's legal area, jurisdiction and legal frameworks
- the active sub-processors of the region
- the class of place where backups are kept
- emergency access grants of the last 365 days
Emergency access
In an emergency, Hermetry operators can be given time-limited access to a node. A grant needs two signatures, every action during it is marked in the audit log of the organisation it touches, and the grant is listed on the residency page.
Choose the region with care. Moving an organisation to another region later is not a self-service action.
On-premises
When data must stay on site
On-premises installation is part of the Enterprise plan.
The same platform
On-premises runs the same code as the hosted regions: devices, dashboards, SCADA, rules, alarms and many organisations in one installation.
Offline licences
A licence can be a signed file checked on your own server, for isolated sites that have no connection to us.
Sized from load tests
We size the servers with you from your device count and message rate, based on our published load tests.
Network
What your network needs to allow
Devices and gateways connect outbound. Nothing on site has to accept connections from the internet, except equipment the cloud polls.
| Traffic | Direction | Details |
|---|---|---|
| MQTT devices | Outbound from the device | TLS on port 8883 to your region's device host, shown on the device's Connection details card. Port 1883 only when the profile allows plain MQTT. |
| HTTPS devices | Outbound from the device | HTTPS to the same device host. |
| LoRaWAN gateways | Outbound from the gateway | Basics Station over a secure WebSocket to your organisation's own network server address. |
| Licensed router web panel | Outbound tunnel from the router | No fixed IP and no port forwarding. Sessions are time-limited and audited. |
| SNMP and camera polling | Inbound to the polled equipment | The equipment needs a public address. Allow the poller's fixed source addresses, listed on the endpoint form. |
FAQ
Questions about deployment
How do we choose a region?
Pick it when you create the organisation: the region your law or contracts require, or the one where most of your devices and users are. See create your account and choose a region.
Can we move to another region later?
Not by yourself. Moving an organisation to another region is not a self-service action; contact us if you need it.
Do our sites need a VPN or a fixed IP address?
No. Devices and licensed gateways connect outbound, and a licensed router's web panel opens through an outbound tunnel. Only equipment that the cloud polls, such as SNMP devices and cameras, needs a public address.
Can we combine on-premises and hosted?
Yes. A site can run on-premises while other sites use a hosted region. Talk to us about how you want to connect them.
How much load can the platform take?
We publish our load tests with their setup and raw figures on the performance page, and size on-premises installations from them.
Planning where Hermetry should run?
Tell us your residency requirements, sites and device count. We help you choose a region, an on-premises installation or both.