Part 5 of 5 in our Security in plain words series, and the last. An integrator's customer should meet the integrator's brand on every screen, and a change of brand should never break the software that reads the data.
Why integrators white-label
An integrator who delivers a plant delivers a system, not a box of parts. Its customer calls the integrator when something needs attention, reads the integrator's manual and expects the integrator's name on the screens. A controller that shows its maker's brand at every login muddies that relationship: the customer is no longer sure whose product it is, or whom to call.
The obvious fix - a custom build of the product for each integrator - creates a worse problem. A fork has to be maintained, tested and kept secure on its own, and it drifts further from the product with every release, security fixes included. The better answer is a product designed to carry someone else's brand without being changed.
A signed brand profile, not a custom build
In CATIM Nimbus the brand comes from a brand profile: one small signed file that sets:
- the logo and its mark, on the login card, in the title bar and in the side bar;
- the company name, wherever the console names the seller, and in the browser tab;
- the console's name, on the login card, in the title bar and in the browser tab;
- the support contact, behind the help link and, when it is a web address, at the foot of the login card.
The console shows the profile read only, so no one rebrands a unit from its own screens; each time the console starts, the unit checks the profile's signature and refuses one that is altered or names another company.
The data interface's server name, and the display name of the controller's root, are the integrator's to set too, so a client exploring the data meets the integrator's names. And the plant's address in the Unified Namespace - its enterprise, site, area and line - is the customer's own, as ISA-95 intends.
Neutral where the profile says nothing
A brand profile raises a question: what shows where the profile leaves something out? Our rule is that every name a customer meets is a default the integrator can replace, and where the profile leaves a value out, or fails its check, the fallback is a plain word - the controller, the console, the Advisor - never our name and never another company's. It matters most in the small places that are easy to miss: the browser tab, the help link, the heading of a page.
Open standards keep their own names. The Unified Namespace, i3X, OPC UA and MQTT belong to no one's brand, which is part of their value: an integrator's customer recognises them whatever is on the login card.
Identifiers that never change with the brand
This is where white-labelling most often goes wrong. If a brand name finds its way into the identifiers that software uses to find data - a namespace, a topic, an object's id - then rebranding a unit breaks every dashboard, historian and script that reads it.
So we keep the two apart. The names people read follow the brand. The identifiers software keys on do not: each namespace in the data interface has a fixed identifier that never changes with the brand, so a client written against one unit keeps working on every unit, whoever's logo is on the screen. A historian subscribed to a value, or a dashboard that reads one by its id, never needs to know whose name is on the login card.
It is the same principle we described for Tributary in Sense, Decide, Act: a change on the unit should never move the addresses its clients depend on.
What a customer's security team will ask
A white-labelled unit is judged hardest by the customer's security team, who see none of the reasons behind it. To them the brand is part of the trust story, so these are fair questions to ask of any controller you put your name on:
- Can you rebrand it without a custom build, and is the brand signed so it cannot be altered on the unit?
- What does your customer see where you have set nothing?
- Does a rebrand change any identifier your software depends on?
- Which names will your customer meet beyond the screens - on the network, in a certificate, in a log - and can each one carry your brand?
- Can the unit's certificate be signed by your own authority? Part 1 of this series shows how that works.
- Who can change the brand once a unit is delivered?
Your name on the work
An integrator's brand is a promise to its customer: we built this, and we stand behind it. The controller inside should keep that promise, not compete with it - on the screen, in the data and in front of the customer's security team.
That closes the series: trust once for every unit, sign-off with no internet, identity by role, the Cyber Resilience Act, and now the brand. If you integrate automation under your own name, talk to us about an edge controller that carries it.
About CATIM. CATIM - Creating Automation Technology In Motion - empowers people to engineer automation solutions that solve hard technical problems. CATIM Nimbus, the CODESYS edge controller with advisory AI, is the next generation of the Nimbus platform it has built since 2019.