Your refinery data stays with you

What can leave your machine

Only these optional features connect to a network. Each is off until you turn it on or use it, and Settings → About and security shows which are on.

• AI assistant (off by default). With a cloud provider, requests go straight from your machine to that provider with your own API key; we never see them. What is sent: the assistant's instructions, your conversation, and compact summaries its tools return (unit and stream names, capacities, specs, solve summaries), plus pages of documents you attach for a migration. Not your whole model file, your assays or your change history. With a local model (Ollama or llama.cpp), nothing leaves your machine or site network. The AI can only propose changes; nothing applies until you press Apply, and it never writes solver input or results.
• Licence activation. Online keys are checked with our payment provider, Lemon Squeezy (the key and a name for the computer). Offline keys never connect.
• Desktop updates. The app can check a public release feed; every update is verified against a signing key built into the app, and you are asked before it installs.
• Team server. If your organisation runs its own PetroSlate team server, shared models go to that server, on your infrastructure, behind your sign-in (OpenID Connect) with roles and an audit log.

PetroSlate never connects to control systems, DCS or historians. Plant data enters only as files you import.

Hardening

• A strict Content Security Policy on this site and the app: no inline or third-party scripts, no framing, no forms posting elsewhere. Fonts and libraries are served from our own site; the offline build has every library inlined.
• HTTPS only, with HSTS, nosniff, no referrer and a locked-down permissions policy.
• The desktop app has no shell and no general file-system access: it can read and write only files you pick.
• Your AI API key is kept in memory unless you choose to remember it on that computer, and is sent only to your provider.
• Files are protected at rest by your operating system's disk encryption and your file-share permissions; PetroSlate adds no encryption of its own.

Supply chain

• Every dependency is pinned by lockfile with integrity hashes; builds fail if a lockfile drifts.
• Dependency advisories are checked in CI (weekly and on every pull request), and a critical one fails it. Automated monthly update requests keep dependencies current.
• Build pipeline actions are pinned to exact commits and run with read-only permissions by default.
• A CycloneDX software bill of materials (SBOM) ships with each desktop release, covering the web app, this site, the team server and the desktop app.
• Desktop installers are code-signed (Apple Developer ID with notarisation, Windows Authenticode) and updates are signed.

Standards

Our development practices are aligned with IEC 62443-4-1 (secure product development), the ISO/IEC 27001:2022 Annex A themes that apply to a software supplier, and the NIST Secure Software Development Framework (SP 800-218). We are not certified against any of them, and no independent penetration test has been done yet. The whitepaper maps each practice to how PetroSlate meets it.

Reporting a vulnerability

Email security@petroslate.com (also listed in security.txt). Please include steps to reproduce and give us reasonable time to fix the issue before you disclose it. Do not access or change data that is not yours. We will acknowledge your report, keep you informed and credit you if you wish.

Security review pack

For a security review we can share the full security whitepaper, pre-filled answers to common security questionnaires, and the SBOM for the version you are evaluating. Ask at access@petroslate.com.