For OT and maintenance
Reach a faulted HMI or PLC from wherever you are, fix it, and skip the drive to site. No client to install, no VPN to set up.
MAAPS Edge
Secure remote access for every machine on the floor.
A compact edge device that sits next to your PLCs and HMIs. Engineers reach them from the browser, plant data streams to MQTT, and nothing on your network is opened to the internet.
Remote access only when you allow it. Data collection around the clock.
01 / Architecture
Architecture and key features.
Everything one MAAPS Edge box does, from the plant network to the cloud.
Up to 100 connections
PLCs, HMIs, cameras and drives across 71 makes, reached through their web page, VNC screen, Telnet or OPC UA server.
Collect data over OPC UA
Read values from up to 8 OPC UA servers and send them to your MQTT broker (3.1, 3.1.1 or 5, with TLS) or a REST endpoint.
Firewall friendly
Outbound HTTPS only, over wired Ethernet or Wi-Fi with automatic switch-over. No open ports, no static IP, no firewall rules to write.
Store and forward
Values queue in memory and on disk (up to 512 MB) when the link drops, then go out in order. The licence stays valid offline for 7 days.
Edge Link for engineering software
Early access: take TIA Portal or Studio 5000 online with one PLC by its IP, limited to that device's address and ports. No routes to set up, no clashing subnets.
Control on site
Ask on screen puts the final yes on the box's own display, and setup over Bluetooth from the Edge Connect phone app takes minutes.
Networking
- 1 × Ethernet for plant and uplink
- Wi-Fi with automatic failover
- Outbound HTTPS / WSS 443 only
- Default-deny host firewall
- No inbound ports, no routing
- Bluetooth LE for setup
Access and data
- Web, VNC (incl. view-only), Telnet
- Edge Link: S7 and EtherNet/IP (early access)
- OPC UA collection
- MQTT 3.1 / 3.1.1 / 5 and REST
- Disk + RAM store and forward
- Live status charts on the box
Security and compliance
- Zero Trust: every session signed and approved
- Ed25519-signed licences, updates and commands
- AES-256-GCM secrets and encrypted backups
- SSO, SCIM, MFA and five roles
- Full audit trail in Admin and on the box
- Email and webhook alerts
Certifications: MAAPS Edge is built to Zero Trust principles. Independent certification and penetration testing are planned; we don't claim IEC 62443 or ISO 27001 certification today.
02 / Who it's for
Made for OT. Trusted by IT.
One box that plant engineers, IT and your machine builders can all agree on.
For IT and security
Outbound HTTPS only, no open ports, no routing into the plant. Single sign-on, MFA and a full audit trail IT can sign off on.
For machine builders
Support the machines you've shipped without asking each customer for a VPN, while the customer keeps the final say on every session.
03 / How it works
Set up on site. Managed from anywhere.
Plug it into the plant network, activate it with a licence key, and add your machines.
PlantPLCs, HMIs, cameras
Web pages, VNC screens, Telnet and OPC UA
On siteMAAPS Edge
Up to 50 devices, behind its own firewall
TransportOutbound only
It calls out. No inbound port is opened.
CloudMAAPS Edge Admin
Licences, sessions, commands and updates
AnywhereYour team
Screens and web pages in the browser
- Step 01
Connect
Wired Ethernet or Wi-Fi, with automatic switch-over between them.
- Step 02
Activate
Type the licence key on the screen. The box checks in with MAAPS Edge Admin and receives a signed licence.
- Step 03
Add your machines
Pick a device found on the network or type its address, then choose its make and device type. Ports fill themselves in.
- Step 04
Work from anywhere
Your team opens screens and web pages from the browser; plant data flows to your broker.
04 / Remote access
Open the machine, not the network.
Remote sessions exist only while someone is connected, and only after every check has passed.
01
In the browser
HMI web pages, VNC screens and Telnet terminals open in a browser tab. Nothing to install on the engineer's laptop.
02
View only, for real
Operators can watch without touching. The box itself drops keyboard and mouse input and blocks changes on web pages.
03
Asked, approved, on time
Every session carries a signed grant from MAAPS Edge Admin. The box checks its own remote access hours and can ask someone on site to tap Allow.
04
Ends by itself
Sessions close when idle, when their time is up, or the moment someone ends them, from Edge Admin or the box.
05
Inside MAAPS CMMS
Show a machine's HMI page right next to its work orders.
GrantSigned by MAAPS Edge Admin✓HoursInside the box's remote access hours✓On siteAllowed on the box's own screen✓ModeView only, enforced on the boxOnIdleCloses by itself when idle15 min
5sessions at most, per box and per person
05 / Data collection
PLC data to MQTT, even through an outage.
MAAPS Edge reads values from your PLCs over OPC UA and delivers them to your MQTT broker or a REST endpoint.
Store and forward
When the network drops, values queue on disk and go out in order once it's back.
See every value
Live status, the last hour, and per-value details: readings, quality, sent and waiting.
Writes stay off
MAAPS can read control points; writing to a PLC stays off until you switch it on.
Keep your topics
Moving from another edge device? Keep the Edge ID your MQTT topics already use.
06 / Security
Closed by default. Signed end to end.
Built for plant networks that must never be exposed to the internet.
01
No open ports
The box only ever calls out. No inbound port is opened on your plant network, and its own firewall blocks everything else.
02
Never a router
MAAPS Edge never routes traffic between the internet and your plant. Every session is one approved connection to one device.
03
Signed everything
Licences, software updates, remote commands and session grants are all signed with Ed25519. The signing keys never touch a box.
04
You decide who and when
Single sign-on, MFA, roles on folders, Manager approval and remote access hours. Ask on screen puts the final yes in the hands of someone on site.
05
Commands with a safety catch
Every remote command is checked on the box for signature, device, expiry and replay. Turn whole categories off on the box; a network change that cuts it off undoes itself in about two minutes.
06
Updates that roll themselves back
Signed updates roll out in stages. A box that fails its health check restores the previous version on its own, and the rollout stops.
07
Revoke in minutes
Each box renews its licence every few minutes. Suspend or revoke a lost or retired box in Edge Admin and it stops.
08
A record of everything
Every change in MAAPS Edge Admin is audited, and the box keeps its own trail of who changed what on site.
07 / Only with MAAPS
More than remote access. Part of your maintenance system.
What MAAPS Edge does beyond getting you onto the machine.
Built into your CMMS
Plant data flows over MQTT straight into MAAPS CMMS to trigger work orders, and a machine's HMI page opens inside the asset record.
Data, not just access
OPC UA collection to MQTT or REST runs around the clock, queues on disk through outages and delivers in order.
Self-healing updates
Signed updates roll out in stages. A box that fails its health check rolls back by itself and the rollout stops.
Undo for network changes
A network change that cuts the box off from MAAPS Edge Admin reverts itself in about two minutes.
Starlight AI ready
Edge data feeds Starlight AI, so trends and anomalies on your machines become maintenance insight.
Australian support
Set-up, training and support from an Australian team, in your time zone.
08 / Machine builders
Work with your vendors, on your terms.
Let OEMs and integrators support their machines without handing them your network.
01
Invite, don't open up
Give a vendor's engineer access to one folder, one machine or one time window, through their own company sign-in.
02
Approve every session
Require a Manager's approval and a tap on the box's screen before an outside engineer connects.
03
See it, end it
Watch live sessions in MAAPS Edge Admin and end any of them with one click. Idle sessions close by themselves.
04
Proof for the audit
Who connected, to what, when, approved by whom: every session and change is recorded for your records and audits.
09 / Scale
Global oversight. Local control.
Run every site from one place, while each site keeps the final say on its own machines.
01
Global oversight
Every box, site and session across your fleet in one portal: health, licences, who is connected and what changed.
02
Local control
Each site sets its own folders, approvers and access hours. Ask on screen lets someone on the floor accept or refuse a session on the box itself.
03
Plug and play
Plug it into the plant network, enter a licence key, add your machines. No firewall rules, no port forwarding, minimal lift from IT.
04
Ready to scale
Up to 50 devices per box and as many boxes as you have sites, rolled out from a single admin portal with staged, signed updates.
10 / Supported devices
70+ makes. One honest list.
Pick the machine's make, or MAAPS Edge if none fits. MAAPS Edge reaches every make through what the device itself offers: its web page, a VNC server, Telnet or OPC UA.
| Device type | What you get | Typical devices |
|---|---|---|
| Web access (WWW) | The device's own web page in the browser | HMI panels, PLC web servers, IP cameras, drives |
| Remote Desktop (VNC) | The live screen, with keyboard and mouse | HMI panels, operator PCs with a VNC server |
| View-only VNC | The live screen, look but don't touch (enforced on the box) | Screens operators and managers watch |
| Telnet | A terminal in the browser (Operate access only) | Devices with a Telnet console |
| Data collection (OPC UA) | Values read on a schedule and sent to MQTT or REST | PLCs with an OPC UA server |
Ready-made forAxis Communications IP cameras · COPA-DATA zenon Web Client and zenon VNC · Grundfos VNC Server
71 makes + MAAPS Edge · as listed on the box
- MAAPS Edge
- Allen-Bradley
- ABB
- Axis Communications
- B&R
- Beckhoff
- Beijer
- Bihl+Wiedemann
- Bosch Rexroth
- BRControls
- Cognex
- Comau Robotics
- Control Techniques
- COPA-DATA
- Crouzet
- Danfoss
- Delta Electronics
- Eaton Moeller
- ELAU
- ESA
- Exor
- FANUC Robotics
- Fatek Automation
- FlexEm
- GE IP
- Grundfos
- Hakko
- Hilscher
- Hirschmann
- Horner
- IDEC
- ifm electronic
- IMO
- InduSoft
- Inovance
- Invensys Wonderware
- Kawasaki Robotics
- Keyence
- Kollmorgen
- Koyo
- KUKA Robotics
- Kvaser
- Lenze
- Mitsubishi Electric
- Moxa
- Omron
- Panasonic
- Parker
- PEAK-System
- Pepperl+Fuchs
- Pilz
- Phoenix Contact
- Priva
- Pro-face
- Rockwell Automation
- RRAMAC, LLC
- Saia-Burgess
- Schneider Electric
- SEW
- Sick
- Siemens
- Stöber
- Stäubli
- Trio Motion
- TP Radio
- Unitronics
- Universal Robots
- Vacon
- VIPA
- Wago
- Weintek
- Yaskawa
Brand names are used only to identify equipment. MAAPS Edge connects to these devices through standard web, VNC, Telnet and OPC UA access; it does not carry vendor engineering software connections.
11 / MAAPS Edge Admin
Every box, one portal.
Licences, health, sessions, commands and updates for your whole fleet, in the browser.
01
Health at a glance
Each box reports its services, disk, temperature, firewall and devices. If one goes quiet, your team gets an email.
- ✓Services
- ✓Disk
- ✓Temperature
- ✓Firewall
- ✓Devices
02
Alerts your way
Email and web hooks from the box, with delays and per-person schedules.
03
Remote commands
Restart a service, fetch logs, change the network or firewall allow-list, signed and checked every time.
04
Staged updates
Canary, pilot, then the fleet, with automatic rollback on any failure.
05
Help from site
Report an issue on the box's screen and MAAPS receives it with recent logs.
12 / Teams
The right people, at the right time.
Bring your own directory and keep control of every connection.
Single sign-on
Microsoft Entra ID, Okta, Google Workspace or any OpenID Connect provider, with domains verified by DNS.
SCIM
Your directory adds, updates and removes people by itself.
Folders and roles
Admin, Manager, Engineer, Operator and Viewer, given on a folder and inherited below it.
Approval and time windows
Require a Manager's approval to connect, and allow remote access only on set days and hours.
13 / Get started
Three ways to get going.
Start small on one line, or plan a rollout across every site.
02
Get a quote
Tell us your sites and machines and we'll price MAAPS Edge to fit your budget.
03
Start a pilot
Try a box on one line of your own plant with our team alongside you, then roll out from there.
Questions, answered.
Do engineers need to install anything?
No. Web pages, VNC screens and Telnet open in the browser after signing in to MAAPS Edge Admin.
Does MAAPS Edge open a port on our firewall?
No. It only calls out over HTTPS. No inbound port is opened on the plant network.
Can someone connect without us knowing?
Every session needs a signed grant and can require a Manager's approval, set hours and a tap on the box's own screen. Sessions can be seen and ended in MAAPS Edge Admin, and close by themselves when idle.
Which machines does it work with?
Any device it can reach on the plant network that offers a web page, a VNC server, Telnet or OPC UA, across 70+ makes such as Siemens, Rockwell Automation, Schneider Electric, Omron and Beckhoff.
Can we program a PLC through it?
Not with the vendor's engineering software: MAAPS Edge doesn't carry those connections. It opens the device's web page or screen, and reads data over OPC UA.
Does it support RDP, VPN or Layer 2 access?
No. MAAPS Edge never routes between the internet and your plant network, by design. Each session is one approved connection to one device.
What happens if the internet drops?
Data keeps being collected and queues on disk, then goes out in order. The licence stays valid offline for up to 7 days.
How many devices can one box handle?
Up to 50 devices.
How is it updated?
With signed updates rolled out in stages from MAAPS Edge Admin. A box that fails its health check rolls back on its own.
How quickly can we roll out across several sites?
A box is set up in minutes: plug it in, enter the licence key and add machines. Boxes for every site are then managed and updated from one MAAPS Edge Admin portal.
How do machine vendors get access?
Invite them to just the folder or machine they support. They sign in with their own company account, and you can require approval, set hours and a tap on the box's screen.
How does it help with security audits and compliance?
It follows Zero Trust principles: no open ports, signed grants for every session, SSO and MFA. Every session and change is logged, so you can show who accessed what and when.
Can we try it before we commit?
Yes. Start a pilot on one line of your own plant with our team, then roll out from there.
Does it work with MAAPS CMMS?
Yes. Plant data flows over MQTT to MAAPS, and a machine's HMI page can be shown inside MAAPS CMMS.
Get started
See MAAPS Edge on your plant.
Book a demo and we'll show remote access and data collection on your own machines.