Sensitive Data Protection

FactoryTalk Optix protects sensitive project data through project‑level encryption, secure credential handling, controlled access to design assets, and secure deployment. These protections apply both during development in FactoryTalk Optix Studio and after deployment to target devices. Project secrets encryption FactoryTalk Optix encrypts sensitive information that is stored in the project, including:
  • User passwords
  • Custom objects that use the Password data type
  • YAML files that represent the project information model
When you create a project, you can enable Secrets Encryption Mode, which ensures that sensitive data is never stored in plaintext within the project files. There are two encryption options.
  • Remote key store – Project secrets are encrypted using keys that are managed through FactoryTalk Hub. You must sign in with an associated organization.
  • User‑provided password – Project secrets are encrypted using a password that was made when you created the project.
Both options ensure that protected data cannot be read or extracted directly from the project files, even if those files are copied outside the development environment.

Protection of Project Files at Rest

FactoryTalk Optix projects are stored as structured files that separate application logic from runtime components. When Secrets Encryption Mode is enabled, sensitive values that are embedded in these files remain encrypted at rest. This action protects intellectual property and credentials if project files are stored in source control systems, shared through collaboration tools, or accessed directly on disk.

Secure Deployment to Target Devices

When a FactoryTalk Optix application is deployed, the compiled application package includes only what is required for execution on the target device. Runtime systems do not expose project source files or decrypted secrets to end users of the target device.

User Authentication and Authorization

Sensitive data access at runtime is protected through role‑based access control (RBAC). User authentication determines who can view, modify, or interact with protected objects, screens, and configuration elements. Even if data exists in the runtime environment, only authorized roles can access it through the user interface or logic execution paths.
Provide Feedback
Have questions or feedback about this documentation? Please submit your feedback here.
Normal