Docs

Architecture and deployment

How the Singularity is deployed, how data physically travels from a plant floor into it, and where that data sits once it arrives.

The deployment model

The Singularity runs in the cloud on AWS. It is multi-tenant, and it is delivered in the browser. A user needs a browser and an account.

One component runs on customer premises: an on-site MQTT client. That client is the entire mode40 footprint inside the plant. The modules, the data models, and the storage all run in the mode40 cloud.

What is not available

  • No on-premises deployment. The platform is not installed in a customer data centre.
  • No air-gapped deployment. The platform requires outbound connectivity to the mode40 cloud.
  • No customer-VPC deployment. The platform is not stood up inside cloud infrastructure a customer controls.

None of these has ever been built for a customer, and none is available today. If a mandate requires the platform itself to run inside your own infrastructure or inside a disconnected network, the Singularity does not meet it. That is worth settling in the first conversation.

The site data path

Data leaves the plant floor along one path:

  1. PLCs and other equipment on the floor expose their signals.
  2. Ignition on site collects those signals over OPC UA, Modbus, or BACnet. Ignition is the recommended on-site collection hub.
  3. The on-site MQTT client publishes the collected data outbound to the mode40 cloud broker.
  4. The broker hands the data to the platform, where the modules read it.

The connection is outbound from your network. The site opens the connection to mode40. No inbound hole in your firewall is required for the platform to receive data, and there is no inbound path to punch through a NAT boundary. TLS protects the MQTT link, and the browser session runs over HTTPS.

The on-site MQTT client is the customer’s to run and configure. It has to publish every device that reports, and the data it publishes has to match the data model agreed for that machine type.

Where the data sits

Databases sit in private VPCs. They are not exposed to the internet, and they are reachable only by the platform backend, which authenticates with a JWT. A browser session never talks to a database directly.

Data is encrypted in transit and at rest. Key management runs on AWS KMS, with tenant-specific keys available as an option. All communication runs on TLS 1.2 or higher. Security and governance covers identity, audit logging, data ownership, and the certification status in full.

Data residency

The AWS region is chosen per customer at onboarding.

  • Canadian data runs in AWS Canada Central, in Montreal.
  • US data runs in US-East or US-West.

Data does not move across a border unless that movement is explicitly configured. The region is a deployment decision made once, at the start, so it belongs on the implementation checklist rather than in a later change request.

The Integration Hub

MQTT off the floor is one input. The Integration Hub is the Foundational Module that handles the rest of the systems an operation already runs.

It speaks REST, SOAP, OPC UA, MQTT, and file-based protocols to source systems.

It reaches the main business software for orders, inventory, and finance (ERP), plant control systems (SCADA), machine controllers (PLCs), connected sensors and IoT devices, quality platforms, scheduling tools, and third-party cloud apps.

Every signal that arrives is schema-normalized and source-tagged, so every module downstream reads the same values and can tell which system produced each one. The Hub writes back to source where a workflow requires it. Connection health monitoring watches each connection, so a dropped feed is flagged before a module works from stale data.

How systems connect covers the Integration Hub in full.