Built for the plant floor, provable to the auditor .
Spectors leads with who a device is allowed to be and how tightly it is contained. Connectivity, identity and isolation come first; telemetry and dashboards are the payoff. Here is how each part actually works.
Native connectors for the protocols you already run.
Modbus/TCP, OPC-UA (read-polling) and Sparkplug B ship as connectors that live outside the core, each confined to the authority of exactly one device. A connector is a two-method adapter against a frozen SDK — adding a protocol adds no new runtime privilege and no new core attack surface. MQTT is native to the embedded broker.
Why it matters: Brownfield plants speak many protocols at once. You bridge OPC-UA, Sparkplug and Modbus into one manageable fleet without ripping out gear or trusting a monolithic bridge with everything.
Southbound write confinement verified against 15+ hostile vectors — injection, null-byte, oversized names, type confusion — all blocked at the wire.
One Sparkplug edge, many isolated identities.
The UNS gateway fans a single Sparkplug edge node into N cryptographically isolated Spectors identities, each with its own per-device command addressing. There is no shared gateway principal that, once compromised, exposes the whole edge.
Why it matters: A Unified Namespace is where modern plants converge their data — but a single shared gateway credential is a single blast radius. Spectors makes the blast radius provably narrower than a monolithic bridge: one device compromised is one identity, not the edge.
Per-device command addressing with no shared gateway principal — blast radius provably narrower than a monolithic bridge.
Tenant separation enforced by the database and the compiler.
Multi-tenant isolation is enforced in PostgreSQL with Row-Level Security — ENABLE + FORCE from the first migration, running on a real non-superuser NOBYPASSRLS role — and again in the Rust type system, where a mandatory TenantCtx parameter on every tenant-scoped query makes a forgotten tenant filter fail to compile. It is structural, not a WHERE clause one bug away from a leak.
Why it matters: Regulated operators — utilities, energy, multi-site infrastructure — need separation they can show an auditor, not just assert. This holds even under adversarial conditions.
Zero rows leak across tenants; the seam survived an RLS-drop and Timescale compression in the same chunk, and 9 Grafana evasion vectors on a real read-only login.
Device auth inside the broker — no hot-path round-trip.
Devices authenticate at MQTT CONNECT inside the broker, validating per-device JWTs against a broker-local JWKS with zero control-plane call on the hot path. If a key refetch fails, the broker keeps its last-known-good set (STRICT), so a control-plane hiccup never becomes a device-auth outage. Key rotation is live.
Why it matters: When the management server blinks, plant devices must keep connecting. Availability of authentication is decoupled from availability of the control plane by design.
10,000 concurrent devices at ~5,400 msg/s QoS1 → p99 49.7 ms (20x under target); a 10,000-client reconnect storm recovered 10,000 / 10,000; live key rotation drops zero established sessions.
Every device is a short-lived, tenant-bound, revocable principal.
Each device carries a short-lived per-device JWT and, where you need it, an internal-CA mTLS certificate — both resolving to the same non-forgeable principal. Tenant is bound by construction from the authenticated identity, never from a request body; keys are asymmetric by type, so the private key structurally cannot leak.
Why it matters: Shared gateway secrets and long-lived credentials are the OT identity problem. Spectors replaces them with per-device identity you can revoke fast, with no residual-access window.
Bounded-latency revocation — device kick measured at 601 µs, far under the 30 s target. Memory-safe TLS via rustls + aws-lc-rs — zero OpenSSL in the transport path.
Internal-CA mTLS with a memory-safe transport.
Where a certificate is the right trust anchor, Spectors issues internal-CA mTLS credentials that resolve to the same device principal as the JWT path — one identity, two proofs. The entire TLS stack is rustls on aws-lc-rs, with no OpenSSL anywhere in the device path.
Why it matters: OT security teams want cryptographic device identity and a transport whose CVE history they can reason about. A memory-safe stack designs out an entire class of transport vulnerabilities rather than patching them.
mTLS and JWT resolve to one non-forgeable principal; transport is rustls + aws-lc-rs, zero OpenSSL.
An in-process rule engine over lossless data.
Threshold, window, absence and geofence rules run in-process and read the lossless, persisted telemetry — never a lossy live bus. Correctness comes from evaluating the source of truth, so there is no external CEP cluster, no Siddhi, no Spark to stand up and babysit.
Why it matters: Plant alerting has to be correct, not approximate. Reading persisted data instead of a sampled stream means a rule sees exactly what happened — and one fewer distributed system to operate.
Threshold / window / absence / geofence evaluated in-process against lossless persisted data — no external stream processor.
Time-series storage and per-tenant dashboards, built in.
Telemetry lands in TimescaleDB hypertables and is exposed through per-tenant Grafana that is provisioned automatically. Each tenant sees its own data and physically cannot read another's — the same isolation guarantee that holds in the core holds in the dashboards.
Why it matters: Operators want dashboards on day one without wiring a separate observability stack — and without a raw-SQL consumer becoming a cross-tenant leak.
Per-tenant Grafana provisioned automatically; a raw-SQL consumer physically cannot read another tenant (9 evasion vectors held).
One or two single binaries, config as code.
Spectors runs as single Rust binaries — an embedded broker and an in-process rule engine — with no external CEP, no extra message bus, and distroless non-root images. Device types are declarative YAML, so onboarding a new type is authoring, not a code-and-deploy cycle.
Why it matters: A small plant platform team cannot babysit a distributed big-data stack. Lean operations and fast onboarding are the difference between a platform and a data-center project.
New device type + connector authored from docs in under a day (no compile, no per-type table). Distroless ~20 MB image (uid 65532, no shell); full database restore drill in ~391 ms against a 4-hour objective.
Real captures, not mockups.
Real captures of the Spectors console on a seeded demo tenant — not mockups.
See it against your own protocols and scale.
Bring your fleet size, your sites and your protocol mix — we'll walk the platform on your terms.
Talk to us →