Security FAQ
Answers to common security review questions, in the format of a vendor self-assessment. For questions not addressed here, contact the TAPP team.
Can TAPP send commands to or modify equipment control systems?
No. TAPP reads equipment data using Modbus TCP read function codes (FC3/FC4) only. Write function codes (FC6/FC16) are never issued.
Because Modbus TCP is a request/response protocol, TAPP’s collection point does exchange traffic with the controller — read requests out, data back — across the protected network. That collection point sits within the protected side. The one-way gateway sits between the protected side and the transport side, so nothing arriving from your network or the internet can reach a control system or issue anything to it.
The Gateway’s one-way path is established in hardware, not configured in software. It is not a setting, and it cannot be changed remotely.
Are equipment control systems connected to the customer network?
No. A control system’s only connection is a direct wired link to the protected side of the TAPP Gateway. The protected side is isolated from the customer network and from the public internet by the one-way TAPP Gateway. There is no network path from the customer network to any connected control system — whether it’s a boiler, a chiller, a water chemistry controller, or other critical equipment.
Can TAPP’s one-way protection be defeated remotely?
No. The direction of data flow through the TAPP Gateway is established in hardware, not configured in software. There is no setting that governs it, so there is no setting for an attacker to change — and no software change, on the Gateway or anywhere else, alters the direction data can travel.
If TAPP’s internet-facing side were compromised, the attacker would gain a monitoring endpoint. There is no forwarding path from there across the Gateway toward the protected side.
Physical access is a different question. Anyone with physical access to the mechanical room can interact with your equipment directly, by connecting to a controller or by altering the equipment itself. That is true whether or not TAPP is installed, and the TAPP Gateway is no more a barrier to it than any other device in the room. TAPP is designed for the remote and network-borne threat; physical site security remains the customer’s control and TAPP assumes it is enforced.
Does TAPP require any inbound firewall rules?
No. All TAPP traffic is outbound-initiated. The Network Router establishes outbound connections to AWS IoT Core (TCP 8883) and to Tailscale for remote management (TCP 443 or UDP 41641). No inbound rules are required, and TAPP does not listen for inbound connections on any interface facing your network.
What does TAPP’s remote access tunnel do exactly? Can TAPP reach our network?
TAPP uses Tailscale (a WireGuard-based mesh VPN) to remotely access the Network Router only — for configuration and diagnostics. The tunnel is outbound-initiated from the router and does not expose any inbound port on the customer network. TAPP’s access is scoped to the Network Router itself using Tailscale access controls ; the tunnel terminates at the Network Router; it does not cross the one-way TAPP Gateway and does not reach any other device on the customer network. If required, the tunnel can be configured to run exclusively over the cellular backup uplink so it never touches the customer network at all. See Remote Access for full details.
What data does TAPP transmit off-site?
Equipment performance telemetry only — controller data (for a boiler, that includes combustion data, operational state, faults and alarms), plus wireless sensor readings (vibration, temperature, pressure/current) from other equipment. No process recipes, no control logic, no personnel data, no IT system data. See Data & Telemetry for the full category list.
Where is TAPP data stored?
AWS (US region). Sub-processor: Amazon Web Services. Data is encrypted in transit (TLS) and at rest per AWS default encryption.
Who owns the data TAPP collects?
Data ownership and permitted use are defined in the data agreement executed as part of the customer contract. Contact your TAPP Account Manager for the current data agreement template.
How does the wireless sensor network work?
TAPP’s wireless sensors form a 900 MHz radio network. Each sensor is a self-contained measurement node that reports readings to a receiving radio on the Network Router — vibration, temperature, pressure, current, analog signals (0–10 V and 4–20 mA), pulse and frequency inputs, and discrete digital inputs. The network is used to instrument tanks, motors, pumps, and other rotating or process equipment where running wire is impractical. The 900 MHz ISM band is chosen for industrial environments because it offers longer range and much better penetration through walls, metal, and dense equipment than 2.4 GHz. The entire wireless network lives on the transport side of the TAPP system — it has no connection to any equipment control system or to the protected side of the TAPP Gateway.
Is the wireless sensor link encrypted?
Not by default. The standard configuration transmits sensor telemetry without radio-layer encryption.
The sensors are read-only measurement nodes confined to the transport side, with no path to the protected side or to any control system, and no ability to issue anything to anything. The worst case for an attacker within radio range is observing equipment-health values or injecting a false reading — which produces a bad data point, not an equipment event.
Radio-layer encryption is available and can be enabled per deployment where site policy requires it. Contact your TAPP Account Manager.
What network segment should TAPP be placed on?
The BMS or building-management VLAN. TAPP does not require access to corporate IT infrastructure. It presents as a single device with one MAC address and accepts DHCP or static IP assignment.
What is the patch and update process for TAPP devices?
TAPP Gateway software updates are applied via USB by a TAPP technician during scheduled maintenance. Remote configuration changes to the Network Router are made via the Tailscale management tunnel. No automatic or unattended software updates are pushed to site without coordination with the customer.