Security
Your project stays on your PC. Your AI works through rails.
TIATool is local software. It sends no telemetry, keeps no copy of your projects, and every change an AI makes goes through backup, verification and your approval.
Data flow
Who sees what
Your project → Your PC only
Exports, the .tiax cache, backups, workspace and journal
tiax-agent and the TIA engines run on the engineering PC as your Windows user. Everything they write lands next to your project or in your own folders. Nothing is uploaded by TIATool.
Your PC → Your AI provider
What your AI assistant reads through the tools
Your AI client (Claude, Cursor, VS Code…) sends tool answers to its model under that provider’s terms. TIATool never contacts an AI provider itself. With a local model, nothing leaves the PC.
Your PC → Licence server
Licence key, machine id, computer name
Only on activation, the daily refresh while online, and deactivation. The machine id is a SHA-256 hash derived from the Windows machine GUID, not the GUID itself; the computer name is shown in your account so you can tell machines apart. A trial request adds your work email. No project data, ever.
Your browser → Stripe and this website
Checkout and your account
Stripe handles card data; we never see it. We keep your email, the Stripe customer and subscription ids, the licence and its activations. This site sets no analytics or advertising cookies, only a sign-in cookie for your account.
Telemetry
None.
No usage analytics, no crash reports, no tool-call logs leave the PC. The only outbound connection TIATool makes on its own is the licence check described above, and it carries no project data. Logs stay on the PC; you decide what to share with support.
Threat model
What stands between a model and your plant
A summary. Each rail is tracked in the capability registry with its verification status.
| Surface | Risk | Control |
|---|---|---|
| MCP over stdio (default) | Another process talking to the server | The server is a child process of your AI client, running as your user. There is no listening port. |
| MCP over HTTP (optional) | Other machines, web pages or users calling the tools | Binds to 127.0.0.1 only. Every request needs a bearer token (tiax-agent token, rotate with --rotate). Browser origins other than localhost are refused, which blocks DNS rebinding. |
| Engine pipe | A local process driving TIA Portal through the engine | Named pipe with a per-user ACL plus a shared secret checked on every connection. |
| Tool arguments from the model | A model injecting command-line switches, for example to skip a backup | Live tools run the same verbs as the CLI with their rails. 0.8 hardens argument passing: values are passed as --key=value and string arguments that look like switches are refused. |
| Every write | An AI change that breaks the project | A new timestamped backup (never overwritten) before the write; refusal while the project is open in the TIA Portal window; imports inside a transaction; a failed action never saves; restore into a new folder or in place with roll-back. |
| After a write | Changes nobody asked for | The verify gate re-exports and compares against your baseline: only the intended blocks changed, interfaces and retain flags intact. Every write lands in the workspace journal. |
| Approval | The model acting without a human | MCP clients ask you before each tool call unless you allow it. Downloading to a PLC needs a confirmation token bound to the exact arguments, and never stops a running CPU unless you allow it. |
| Scripts | AI-written code running against the Openness API | Read scripts run in a transaction that is never committed. Write scripts go through the same licence, approval, backup and verify pipeline as every other write. The deny-list scan is a guard rail, not a sandbox: treat a script like code you run yourself. |
| Licence tokens | Forged or replayed licences | Ed25519-signed tokens, verified offline on the PC, bound to the machine id and capped at the paid period. |
| Installer | A tampered download | The one-line installer compares the file with the SHA-256 published at /download.sha256 and stops on a mismatch. Installing by hand? Check the hash yourself first. The preview installer is not code-signed yet. |
Status of each rail: safety rails. Architecture details: agent and engines.
Responsible disclosure
Found a vulnerability? Tell us first.
Email hello@truesmarttech.com with the subject “Security report”: what you found, the version (tiax-agent --version) and steps to reproduce. Please do not include project data from third parties.
We confirm receipt within three working days, keep you updated until the issue is fixed, and credit you in the changelog if you wish. Please give us 90 days before you publish. We will not take legal action against good-faith research that respects these rules and does not harm customers, their data or their plants.
Machine-readable contact: /.well-known/security.txt. General questions: hello@truesmarttech.com.