Built for the OT security review.

StreamSight is cloud-hosted in a dedicated environment for each customer. It reads your PI System through a connector that only connects outbound from your network, and your engineers decide what to do with what the agent finds. This page answers what plant IT, OT security, and purchasing ask before a pilot.

your networkPI SystemData Archive and AFAF SDK · read-onlyStreamSight connectorsigned Windows serviceStreamSight cloud · yours aloneedgeTLS, the only public listenerapplication and agentdatabaseno public endpointoutbound onlyTLS · port 443your engineers' browsersHTTPS
Deployment
Single-tenant, on StreamSight-managed AWS in a US region: your own application instance, database, and private network.
Connector
A signed Windows service that your staff install and operate on your network. It reads the PI System through the AF SDK, read-only, under a PI identity you control. That identity's PI security decides which tags StreamSight can see.
Connectivity
The connector opens one secure connection outbound on port 443. StreamSight never initiates a connection into your network.
Updates
Connector updates are code-signed and verified before install. By default they are applied only when your admin approves, and a failed update rolls back.
Plant control
StreamSight only reads from the PI System and cannot control plant equipment. It observes and advises.
Oversight
Engineers review the changes the agent proposes and make the operational decisions.
Your data
Configured tag values, point and AF metadata, history windows read on demand, and the documents you upload leave your network. All of it goes only to your dedicated environment.
AI models
Diagram context, summary results, and page images of documents the agent is asked to read go to commercial LLM APIs. Bulk tag history and whole uploaded data files do not.
Agent code
Code the agent writes runs in an isolated sandbox with no internet access.
Sign-in
StreamSight accounts today. Sign-in through your Microsoft Entra ID tenant follows the first release.

Who owns what.

StreamSight

The product, your hosted environment, the agent and its tool catalog, and the connector software.

Customer

The connector host, the PI identity and its permissions, who has access, and how proposals get reviewed.

Together

Connector setup and the security review.

What we need from you.

  1. 1PI Data Archive and AF Server hostnames.
  2. 2A read-only PI identity for the connector's Windows service account.
  3. 3A Windows Server VM for the connector.
  4. 4Outbound port 443 from that host to StreamSight.
  5. 5Plant documents for the equipment in scope: P&IDs, equipment and instrument lists, process descriptions.
  6. 6A contact for the security review.

Firewall flows.

Connector host → Your PI Data Archive and AF Server
Internal, ports 5450 and 5457
Connector host → StreamSight
Outbound only, port 443
Engineers' browsers → StreamSight
Outbound, port 443