Fail-safe stop
38 ms
Built for export-controlled programs and airworthy structure
Rivetira writes instructions to machines that build flight-critical structure. That imposes two obligations at once: protect the program data, and never let software be the reason a machine does something unsafe.
Inbound firewall ports
0
Audit record retention
7 yr
Unauthorised access events
0
Attestations and program frameworks
Where a control is in progress rather than attested, it is marked as such. We do not claim certifications we do not hold.
Attested
SOC 2 Type II
Annual audit covering security, availability and confidentiality. Report available under NDA.
Supported
ITAR / EAR
US-person access controls, on-shore data residency and air-gapped deployment for controlled technical data.
Aligned
AS9100 Rev D
Quality records structured to support your AS9100 quality management system and audit evidence.
Mapped
NIST SP 800-171
Controls mapped for CUI handling on defense programs. [PLACEHOLDER: assessment date.]
In progress
ISO 27001
Information security management system certification.
In progress
CMMC Level 2
Required for certain DoD program participation. [PLACEHOLDER: target window.]
Software never sits on the safety path
The stop is hardware. Agents can request motion, but they cannot override an interlock, and losing the network never leaves an actuator in an indeterminate state.
- Category 3 / PL d safety circuit, independent of the Rivetira runtime
- 38 ms p99 fail-safe stop measured end-to-end at the actuator
- Every agent instruction is idempotent — a retry never double-drills
- Envelope enforcement: an instruction outside the qualified process window is rejected at the edge, not at the cloud
- Autonomy level is a station-level setting a human sets and can revoke instantly
| Fail-safe stop latency (ms) | Observations | Within spec |
|---|---|---|
| 16–20 | 41 | Yes |
| 20–24 | 168 | Yes |
| 24–28 | 402 | Yes |
| 28–32 | 611 | Yes |
| 32–36 | 388 | Yes |
| 36–40 | 142 | Yes |
| 40–44 | 21 | Yes |
| 44–48 | 3 | Yes |
Program data stays where you put it
Geometry, imagery, metrology and the as-built record live on your factory edge. What leaves — if anything — is a decision you configure per program.
- STEP 01
Capture at the edge
Cameras, trackers and machine telemetry write to edge storage inside your network. No raw imagery leaves the plant by default.
Default egress of raw imageryNone
- STEP 02
Process locally
Perception, planning and control all execute on the factory edge. Inference does not depend on a cloud round trip.
Perception loopOn-prem
- STEP 03
Classify and gate
Records are tagged by program and export classification. Controlled records are pinned to on-shore, US-person-only storage.
Classification enforcementRecord layer
- STEP 04
Sync what you allow
Optional derived, de-identified features sync to the control plane for fleet learning. Air-gapped sites sync nothing.
Configurable egressDown to zero
Three topologies, one product
Connected edge
Factory edge runtime with an outbound-only link to the Rivetira control plane for model delivery, fleet analytics and support. Most common for commercial programs.
On-premises control plane
The control plane runs inside your data centre. Rivetira has no network access; updates arrive as signed artefacts you approve and install.
Air-gapped
No network path exists. Models and updates arrive on signed offline media; telemetry never leaves. Standard for ITAR and classified programs.
| Capability | Connected edge | On-premises | Air-gapped |
|---|---|---|---|
| All seven agents | Yes | Yes | Yes |
| Closed-loop autonomy | Yes | Yes | Yes |
| As-built twin | Yes | Yes | Yes |
| Continuous model updates | Automatic | Approved artefacts | Offline media |
| Fleet learning across sites | Yes, opt-in | Within your fleet | Within the site |
| Rivetira remote support | Yes | Screen-share only | On-site only |
| Telemetry egress | Configurable | None | None |
An audit trail an auditor can actually use
Every hole, fastener, shim, seal and disposition is written once, hash-chained, and never edited. Corrections are appended, so the history of a decision survives.
- Append-only, hash-chained records per airframe serial
- Machine, program version, model version and operator captured per operation
- Full trace for a serial exported in under 90 seconds
- Every autonomy promotion, override and rollback is a logged, attributed event
- Export events themselves are logged, including who and to where
| Category | Median audit response time |
|---|---|
| Spot sample | 312.0 h |
| Manual 100% | 96.0 h |
| Rivetira | 1.5 h |
The control surface, itemised
- Encryption at rest
- AES-256
- Encryption in transit
- TLS 1.3
- Key management
- Customer-managed option
- Secrets
- Hardware-backed at the edge
- Artefact signing
- Every model and binary
- SSO
- SAML 2.0 / OIDC
- Provisioning
- SCIM 2.0
- MFA
- Enforced org-wide
- RBAC granularity
- Site → station → agent
- Break-glass
- Dual-approval, audited
- Pen testing
- Annual, third party
- Vulnerability SLA
- Critical < 24 h
- Backup RPO / RTO
- 15 min / 4 h
- Sub-processors
- Published, notified
- Incident notification
- < 24 h
How autonomy is earned, and how it is taken back
| Measurement point | Deviation from nominal |
|---|---|
| Shadow → advisory | +96% |
| Advisory → supervised | +78% |
| Supervised → closed loop | +61% |
| Promotions later rolled back | -7% |
| Rollbacks triggered by twin drift | -4% |
| Rollbacks triggered by operator | -3% |
Built for programs that cannot leak and cannot fail
Airframe geometry is among the most protected IP in manufacturing, and much of it is export-controlled. Rivetira is architected for that reality from the edge up.
Certified
SOC 2 Type II
Annual audit covering security, availability and confidentiality of the control plane.
Supported
ITAR / EAR aware
US-person access controls, on-prem and air-gapped deployment for controlled programs.
Mapped
AS9100 alignment
Quality records, NCR flow and traceability mapped to aerospace quality requirements.
In progress
ISO 27001
Information security management system certification underway. [PLACEHOLDER: target date]
Data stays where the airframe is
- Factory edge runtime holds all program geometry, imagery and metrology locally
- Air-gapped mode: model updates arrive by signed media, telemetry never leaves
- Per-tenant isolation and per-program cryptographic separation
- Encryption in transit and at rest; customer-managed keys available
Assurance-grade by default
- Immutable audit trail for every agent action, sensor reading and human override
- SSO/SAML, SCIM provisioning and role-based access down to station level
- Fail-safe stop for drills, fasteners, crawlers and cranes at < 40 ms
- Human-in-the-loop mandatory for airworthiness-critical dispositions
Shadow first. Autonomy is earned, not switched on.
Every agent starts by watching. It is promoted only when its measured accuracy clears the mechanic-plus-metrology baseline and the twin agrees.
-
Weeks 1–4
Shadow
Agent observes the station, predicts every outcome, actuates nothing. Accuracy measured against what the mechanics actually do.
-
Weeks 4–10
Advisory
Agent recommends feed, shim geometry and sequence. A human accepts or rejects; every rejection becomes training data.
-
Weeks 10–20
Supervised
Agent actuates with a human in the loop and a live fail-safe stop. Airworthiness-critical dispositions still require sign-off.
-
Week 20+
Closed loop
Agent runs the step. Humans handle exceptions and the twin gates any change to the control policy.
| Week | Agent accuracy | Mechanic + metrology baseline |
|---|---|---|
| Wk 2 | 88.2% | 94.1% |
| Wk 4 | 91.4% | 94.0% |
| Wk 6 | 93.6% | 94.2% |
| Wk 8 | 95.2% | 94.1% |
| Wk 10 | 96.4% | 94.3% |
| Wk 12 | 97.1% | 94.2% |
| Wk 16 | 97.8% | 94.1% |
| Wk 20 | 98.3% | 94.2% |
| Wk 24 | 98.6% | 94.3% |
Reads and writes back to the machines you already own
Rivetira is not a rip-and-replace. It connects to the drilling machines, crawlers, trackers, shim cells, sealant robots and MES already on your floor over APIs and OT protocols.
Drilling & fastening
- Flex-track crawlers
- Gantry drilling machines
- C-frame riveters
- Automated fastening cells
- Hand-fed ADUs
Metrology
- Laser trackers
- Photogrammetry rigs
- Structured-light scanners
- iGPS / indoor GPS
- Articulated arm CMMs
Shimming & sealing
- 5-axis shim machining
- Liquid shim dispense
- Sealant robots
- Cure monitoring
- Bead inspection
Factory systems
- Assembly MES
- PLM / as-designed models
- ERP work orders
- Quality / NCR systems
- Historians & OPC UA
OPC UA, MTConnect, MQTT, ROS 2, REST and file-drop connectors. Read-only shadow mode first; write-back enabled only after twin validation.
Questions engineers actually ask
Anything else goes to the people who build it. Ask an assembly engineer or read the full FAQ.
Air-gapped deployment supports controlled and classified environments where the customer owns the enclave and the accreditation. Rivetira personnel with the required clearances support on-site; we do not hold or process classified data ourselves.
Not by default and never on controlled programs. Where you explicitly opt in, training uses de-identified derived features — gap fields, process signatures, defect labels — not raw imagery or program geometry, and never crosses customer boundaries.
Nothing on the line stops. The edge runtime holds current models and continues operating. Agents fall back to advisory if the outage exceeds the configured window, so a human confirms each step rather than the line halting.
Yes, under NDA. The security pack includes the SOC 2 Type II report, the most recent penetration test executive summary, the sub-processor list, our incident response policy and the safety architecture description.
Access control is enforced at the record layer, not just the UI. Records tagged as controlled technical data are only retrievable by identities attested as US persons, and every retrieval is logged with the identity and destination.
Get the security pack
A line assessment maps one station, quantifies the rework, shim and rate opportunity, and returns a modelled ROI in three weeks. No production disruption.