The solution
From PLC signal to decision – in real time.
MectoSYS connects hardware on your shop floor to a secure cloud platform. You get both from one source: gateway, setup and software.
Architecture
One collection point for all machines
Instead of accessing every controller, we bring our own data PLC. Your machines write the data you release into it. Controller, program and access rights stay entirely with you, and it does not matter who made your controllers.
- 01
Create a tag
You create a tag in MectoSYS, such as “Part count line 2”. The platform assigns it a fixed address in the data PLC.
- 02
Send
Your machine writes the value to that address: Siemens controllers via PUT, other makes e.g. via Modbus TCP. You decide what is sent.
- 03
Transmit
The data PLC (SIMATIC S7-1200) provides all values via OPC UA. The gateway (SIMATIC IOT2050) reads them every second, transmits them via MQTT over mTLS and buffers if the network fails.
- 04
Analyse
The platform turns signals into machine states, records downtime and calculates KPIs such as OEE.
Operating models
Your data stays where you decide.
MectoSYS is available as a cloud service and for operation inside your own network. Features and operation are identical.
| Aspect | MectoSYS Cloud | MectoSYS On-Premise |
|---|---|---|
| Data storage | Data centre in Frankfurt am Main (EU) | Server or virtual machine in your plant. Production data never leaves your network. |
| External connection | Outbound only, MQTT over mTLS | Not required |
| Operation and updates | Fully handled by MectoSYS | Software and updates from MectoSYS, running on your infrastructure |
| Remote maintenance | Included | Only with your approval |
| Best for | A fast start without your own IT infrastructure | Strict data protection or customer requirements and isolated networks |
Modules
One platform, one data model
Every module works on the same live data – from the machine to plant management. We start with what helps you most and expand together.
Production
Live line status across all sites, downtime capture with reasons, OEE, production orders and Andon boards.
Quality
Record and analyse defects and scrap – linked to machine, time and process state.
Workforce
Shift models, rosters, attendance and a skill matrix – in the same picture as production.
Audit & compliance
A complete change log with roles and permissions – traceable for customer and certification audits.
Maintenance
Maintenance orders and condition-based maintenance driven by machine data.
Traceability
Material and batch tracking along the line.
AI features
Predictive maintenance and anomaly detection on your historical data.
Security
Security at every layer
A connection from the shop floor to the cloud has to convince your IT and OT teams. That is why security is part of the MectoSYS architecture, not an afterthought.
- No access to your controller
- MectoSYS never connects to your machine PLC. Your machine writes the released data into the data PLC itself. Program, know-how protection and access rights stay unchanged with you.
- Network segmentation
- OT traffic (OPC UA) and management traffic run in separate VLANs. The architecture follows the zones-and-conduits model of IEC 62443.
- Encryption
- OPC UA with Basic256Sha256 and SignAndEncrypt between data PLC and gateway; MQTT over TLS with mutual authentication (mTLS) to the cloud.
- Device identity
- A dedicated MectoSYS root CA issues each gateway its own X.509 certificate. Certificates are rotated and can be revoked at any time.
- Tenant isolation
- Every query is bound to your company – additionally enforced by row-level security in the database. Each gateway may only publish to its own MQTT topics.
- Roles & permissions
- Fine-grained permissions per module and user; every change is recorded in the audit log.
- Hosted in the EU
- The cloud runs in a data centre in Frankfurt am Main. Alternatively, you run MectoSYS on-premise in your own network. Your production data belongs to you.
NIS2 and Cyber Resilience Act
Ready for the new EU cybersecurity obligations.
Cybersecurity in production is now mandatory in the EU: NIS2 for operators, the Cyber Resilience Act and the new Machinery Regulation for manufacturers. MectoSYS is built to support these requirements instead of creating new attack surfaces.
NIS2 Directive
For manufacturing companies
Many mid-sized manufacturers, for example in machinery, electrical engineering and automotive, now fall under NIS2 for the first time. It requires risk management, access control, encryption, logging and supply-chain security, among other things.
How MectoSYS supports you
- No access to your controllers from outside
- Encryption and device certificates on every connection
- Roles, permissions and a complete audit log
- Hosting in the EU or on-premise in your plant
Cyber Resilience Act
For makers of connected products
The CRA applies to products with digital elements on the EU market. Reporting obligations for actively exploited vulnerabilities apply since September 2026, the remaining obligations from December 2027. Data and remote-service components you ship with your machine have to fit in.
How MectoSYS supports you
- Security by design: secure defaults, outbound connections only
- Security updates for platform and gateway
- Remote access only after approval, with personal, revocable certificates
- Data collection without access to your control program
Machinery Regulation (EU) 2023/1230
For machine and line builders
From 20 January 2027, the new Machinery Regulation requires machines to be protected against corruption, including over network connections. Data connections and remote access must not compromise safety functions.
How MectoSYS supports you
- Your machine sends only released data; data collection never writes back
- Your control program and its protection features stay unchanged
- Network segmentation following the IEC 62443 zones-and-conduits model
- Remote interventions only in coordination with the staff on site
Our architecture is based on the IEC 62443 series for security in industrial automation. MectoSYS does not replace a legal assessment of your obligations. We are happy to show you which requirements MectoSYS supports in practice.
Requirements
What you need to get started
- 01
Machines that can send data
Siemens S7 or controllers of other makes, e.g. with Modbus TCP. Your controller does not need its own OPC UA server.
- 02
One send block per machine
Your automation engineer or machine builder adds a block that writes the released data to the addresses MectoSYS assigns. The machine logic stays unchanged; we can help.
- 03
Cabinet space and network
For the DIN-rail data PLC and gateway, with a network connection to the machines. Internet outbound only, and not at all on-premise.
- 04
A contact person
From production, maintenance or automation who knows the line.
For machine and line builders
Ship your machines connected
Your customers expect condition data and remote diagnostics. MectoSYS can ship with your machines as the monitoring layer – without you building your own IIoT stack.
FAQ
What production managers ask us
Do we have to change the PLC program?
Only minimally. A send block is added to the program that writes the released data to the addresses MectoSYS assigns in the data PLC. The machine logic stays unchanged, and MectoSYS never accesses your controller. We support you or your machine builder with this.
Does MectoSYS only work with Siemens controllers?
No. The MectoSYS data PLC is a SIMATIC S7-1200, but your machines can come from different makers. Siemens controllers send via PUT, others e.g. via Modbus TCP. We check your machines in the first conversation.
What happens if the internet goes down?
The machine keeps running. The data PLC and gateway keep collecting; the gateway buffers locally and sends the data once the connection is back.
Where is our data stored, and who owns it?
Your choice: in our cloud in a Frankfurt am Main data centre (EU), or on-premise on a server in your plant, in which case the data never leaves your network. Either way, the production data belongs to you; we use it solely to operate the service for you.
Does it work with older machines?
In many cases, yes. Your controller does not need an OPC UA server; it only has to be able to send data, e.g. via S7 communication or Modbus TCP. Many older controllers can. We check the right connection in the pilot conversation.
Does MectoSYS help with NIS2 and the Cyber Resilience Act?
MectoSYS supports key measures such as access control, encryption, logging and controlled remote access, and it creates no access to your controllers from outside. It does not replace a legal assessment of your obligations.
How much does MectoSYS cost?
We are developing our pricing model together with our pilot partners. We agree pilot terms individually in the first conversation.
Would you like to test MectoSYS on your line?
We are looking for manufacturers for our pilot programme. In a first call (30 minutes, online) we check whether your plant is a fit.
Or give us a call: +49 1551 0940487