Nothing
By default · every outbound call optional and listed below
Nothing of yours leaves the plant. Here is the whole list.
Security · the IT / OT review · LK On · LK Up · LK Go
No cloud account, no vendor-held data, no inbound connection from the internet. Every outbound connection the three products can make is on this page, optional and switched on by your administrator. Over the internet they read; they never write. A write to the machine happens on site, per tag, after a confirmation, and from a phone only with a physical key turned. What we do not claim is written here too.
Every statement below comes from the code of the three products as of November 2026, with the file it lives in named on request. Send us your questionnaire; the developer answers it.
Leaves the plant
Inbound from the internet
None
No open ports, no vendor access · remote viewing only through your own VPN
Writes over the internet
Refused
Always, every role · on site: per tag, confirmed, physical key, logged
Not claimed
Four things
Certified HMI · safety device · outside audit · signed Windows installer
The diagramIT / OT isolation
Four zones, and what crosses between them
The machine network never gets a route to the internet through us. LK On sits between the machine and the plant network with two ports; the plant network is where phones, the LK Up server and your own VPN live; the internet sees outbound connections only, and only the ones you turn on.
What leaves the plantEvery outbound connection
Nothing by default. These are the switches.
There is no telemetry, no analytics, no crash reporting and no update beacon in any of the three products; the fonts are bundled, nothing is fetched from a CDN. What can go out is here, by product, and each line is a setting your administrator turns on.
| LK Go (the phone app) | Nothing. The phone talks to the controller on the local network and keeps the values on the phone. The only internet it ever uses is the App Store for the app itself. |
|---|---|
| LK On (the device) | Nothing by default. Optional, each off until an engineer turns it on: Telegram (api.telegram.org) and WhatsApp (Meta's API) for alarms and the morning digest; Tailscale for your own VPN, view only; the update channel (a signed manifest on GitHub, fetched only when an engineer presses Update, or carried in on a USB stick); the link to LK Up, which is on the plant network, not the internet. No clock server is set by us. |
| LK Up (the server on your PC) | Nothing by default. Optional: Telegram bot, SMTP to the mail server you name, webhooks to URLs you configure (10-second timeout, no redirects, HMAC-SHA256 signature), the push relay for native app notifications only if you set one, and your own identity provider if you turn on single sign-on. No update check is made by the server; new versions appear on the LK Up page. |
| This website | Hosted on Vercel; the preorder reservation list in a Redis store, card payment by Stripe, contact forms to the developer's Telegram, transactional email by Resend. The privacy policy lists all of it. |
What listensPorts on the plant network
What listens, where, and what does not
| LK Go | Listens on nothing. Outbound TCP to the controller only: EtherNet/IP 44818, S7comm 102, Modbus TCP 502, the same request types an HMI issues, with the polling load of about one extra HMI screen. The full note for an IT / OT review is on the app page. |
|---|---|
| LK On | The web interface on TCP 5000 (HTTP, on the plant side) and a redirect on TCP 80; it announces itself with mDNS as _linekeeper._tcp so LK Go finds it. The history database listens on the loopback only. The machine port (port 1) talks to the PLC and carries no default route, so nothing on the machine side reaches the internet through the device. For the first minutes after a fresh install the device raises its own setup hotspot so you can give it a network; it can be switched off for good. There is no VNC; SSH is the operating system's, for the person who installs the device. |
| LK Up | HTTPS on TCP 8420, on all interfaces of the PC you install it on (changeable). It issues its own local certificate authority on first start (ECDSA P-256; the private key is readable by the service account only) and a certificate for the PC's names and addresses, renewed on its own. Phones and browsers pin the authority's fingerprint from the QR code you show them, or trust it on first use and warn if it ever changes. The Windows installer adds a firewall rule for 8420 and puts the authority into the machine's trusted root store, and removes both on uninstall; on a Mac trusting the certificate is a step you take yourself. The server runs as a Windows service or a macOS background item and starts after a reboot. |
Who can writeTo the machine, and from where
Reads from anywhere you allow. Writes only on site, with a key.
The rule is permanent and lives in the code, not in a setting: over the internet the products read; a write to the machine happens on the plant, per tag, after a confirmation, and from a phone or a laptop only while a physical key is turned.
- LK On knows where a request comes from. Its own screen, the plant network, or a VPN or proxy (the Tailscale address range, any proxy header, any unknown peer). Over a VPN or proxy every write and every alarm acknowledgment is refused with a logged 403; viewing, history and settings stay open to the people you allowed. An acknowledgment must mean someone on site saw it.
- A write from a phone or a browser needs the LOCAL / REMOTE key. A physical key switch wired to one of the device's inputs (or a PLC tag where there are no inputs). Turning it to REMOTE opens a window, 15 minutes by default, for writes from LK Go or a browser on the plant network. A broken wire reads LOCAL. No key assigned means no remote control, and the screens say so.
- Per tag, confirmed, inside limits. Writable tags are unlocked one by one by an engineer; a bit write asks for confirmation; a setpoint from a phone is checked against its minimum and maximum; motion is hold-to-run with a lease of three quarters of a second and a heartbeat, and a lost connection writes zero. Tags whose name says safety are blocked: a naming heuristic, not a safety function.
- Everything is in the audit log. Role, client, origin, person, tag, value, result, time; refusals too. The last twenty thousand entries stay on the device.
- LK Go without a device writes only on the local network, after a paid unlock, per tag, with a confirmation on every value; the free app cannot write at all. LK Up controls nothing on the machine: it records maintenance work and receives what LK On sends it.
A remote programmer's own VPN session to the PLC, past LK On, is a planned feature with the same consent rule: an operator's Allow at the machine or the physical key opens a time-boxed session with a banner and a log. Until it ships, there is no such path through us.
Sign-inPeople, roles, sessions
Who gets in, and how it is stored
| LK Up accounts | Passwords hashed with scrypt and a random salt; PINs the same way. Passkeys (WebAuthn) and a second factor by authenticator app (TOTP, with ten recovery codes, locked after ten wrong codes in a week; the secret encrypted at rest). Single sign-on through your own identity provider over OpenID Connect with PKCE, in browsers today. Sessions slide for 30 days; a station PIN session ends after 12 hours; five wrong sign-ins in five minutes lock the attempt. API tokens are stored hashed, carry scopes (read, write, calendar, notify) and expire, 365 days by default. The audit log is a separate database the server alone writes. |
|---|---|
| LK On people | Four roles: engineer, mechanic, operator, viewer; anything not granted to a role is engineer-only, updates included. PINs hashed with PBKDF2-HMAC-SHA256 (60,000 rounds, random salt), five wrong PINs lock for a minute; badges and fobs through a reader, shown masked; a physical access key on the rear terminals can identify a person. Session tokens are stored hashed; an engineer session ends after 24 hours, an operator's after 7 days, and the screen signs an idle person out. |
| The device's own screen | Boots straight into a locked browser: no desktop, no address bar, password manager and sign-in disabled by policy. The operator sees the panel and the machine screens; Setup and the PLC program need a PIN of a higher role. |
UpdatesSigned, manual, reversible
Nothing updates itself
| LK On | An engineer presses Update. The device fetches a manifest signed with Ed25519 and a tarball whose SHA-256 and size are checked against it; a bad signature stops the update. The signing key never leaves the developer's machine. Three failed starts roll the device back to the previous release by themselves. A plant with no internet brings the same signed bundle on a USB stick. |
|---|---|
| LK Up | The server makes no update call. New versions are published on the LK Up page with their SHA-256; you install when you choose. The Mac app is notarized by Apple. The Windows installer is not code-signed yet: Windows SmartScreen shows a warning on first run, and the checksum on the page is how you verify it until the company's signing certificate exists. |
| LK Go and the LK Up iPhone app | Through the App Store, under its review and signing. |
Your dataWhere it is, how it leaves with you
On your PC, on the device, on your phones. Exportable, erasable.
| LK Up | One SQLite database on the PC you chose. A snapshot every night at two, fourteen kept, copies to a disk or network path you name; restore from any of them. The server's own keys (instance key, certificate authority, configuration) can be exported as one file encrypted with a passphrase (scrypt and AES-256-GCM). Export of everything to CSV, Excel or JSON at any time. The snapshots themselves are plain files: put them on an encrypted disk, we do not encrypt them for you. An "electronic records" mode keeps a reason for every change to a done or closed work order, re-asks the password on a signature and exports the audit trail; we call it 21 CFR Part 11 ready, never compliant, because compliance is the plant's validation, not a product feature. |
|---|---|
| LK On | The machine's configuration, events, the learned model and the history stay on the device (history raw for 30 days, hourly for a year, daily for five). Export per tag to CSV, the whole machine as one file, a USB export. A factory reset needs an engineer and the word RESET, and wipes everything including the audit log and people. The device does not encrypt its disk; it is meant to sit inside the cabinet. |
| Phones | The LK Up app keeps a working copy for offline use; what it has not sent yet is encrypted per row (AES-GCM-256) with a key in the phone's Keychain or Keystore. "Forget this server" drops the session first and the certificate pin second, and the server can forget a phone from its side. LK Go keeps dashboards and history on the phone only. |
The online serverLK Up · planned
When LK Up runs on our host: what changes, what does not
An online LK Up is planned: the same server, hosted by us, for three cases. An off-site copy of your plant server. A plant with no PC of its own, where the online server is the primary. A try before anything is installed. Nothing on this page changes for a plant that does not use it.
| What exists today | A stateless push relay for native app notifications: it holds the Apple and Google push keys and sees no plant records. It is used only if your server is pointed at it. |
|---|---|
| What stays true | Your records are yours: one organisation per plant, export at any time, and moving the primary server between your PC and our host is a planned procedure in both directions, done after the old primary stops. One primary at a time: the copy is never promoted on its own while your plant is cut off, because that would leave two. |
| What changes | Your records live on our host too, encrypted in transit and at rest by the host. A phone writing from outside your network goes through a queue that waits for the plant's approval. Pairing uses the server's instance key and an eight-digit code, with short-lived signed tokens. |
| Not decided yet | End-to-end encryption of the records and who holds the keys; the host and its country; the terms of the paid tier. We will write them here before the online server takes a customer's data, not after. |
Not claimedRead this before the questionnaire
What we do not claim
- Not a certified HMI and not a safety device. The PLC's safety program, lockout / tagout and the machine's guards stay in charge. Safety tags are blocked by their name: a heuristic. A machine-safety specialist reviews the scheme before motion is enabled from a phone.
- No third-party penetration test or audit yet. The rules here come from our own code and review. When an outside audit exists, it will be linked on this page.
- The Windows installer of LK Up is not code-signed yet. The published SHA-256 is the check until the certificate exists.
- No encryption at rest by us. The device's disk and the LK Up database and snapshots are plain files; use the disk encryption of the PC and keep the device in the cabinet.
- Not protected against what is outside our code. A phone writing straight to the PLC with other software, a sign-in to the device's operating system, a power loss in the middle of a command.
- A small company. One developer answers. The support model is on the support page; the data stays with you whatever happens to us.
FAQFair questions from IT and OT
Fair questions from IT and OT
Does any of our data go to LineKeeper's servers?
No. There is no cloud account and no vendor-held data. LK Go talks to the controller directly on the plant network. LK On and LK Up keep everything on the device and on your own PC. Every outbound connection they can make is optional, listed above, and switched on by your administrator. No telemetry, no analytics, no crash reports.
Can anything write to the machine over the internet?
No, and this is permanent, not a setting. Over a VPN or proxy every write and every alarm acknowledgment is refused and logged. A write from a phone or a laptop on the plant network also needs the physical LOCAL / REMOTE key, and motion is hold-to-run with a short lease. LK Up controls nothing on the machine. LK Go writes only on the local network, per tag, after confirmation.
What does the planned online server for LK Up change?
It is the same LK Up hosted by us, for an off-site copy, a plant with no PC, or a try before installing. Your records then live on our host too, encrypted in transit and at rest by the host; end-to-end encryption and key custody are not decided yet and will be written here before the server takes a customer's data. Today only a stateless push relay exists.
Has LineKeeper been penetration-tested or audited by a third party?
Not yet, and we do not claim it. When an outside audit exists it will be linked here.
Is LineKeeper a certified HMI or a safety device?
No. LK On and LK Go are monitoring and backup-HMI tools; safety tags are blocked by name, which is a naming heuristic, not a safety function. The PLC's safety program, lockout / tagout and the machine's own guards stay in charge.
We have a security questionnaire. Who fills it in?
The developer. Send it through the contact form with the product you are reviewing; every answer points at the file in the code it comes from.