Security & Data Handling

TIA Openness Manager MCP and the account and licence server

TIA Openness Manager MCP lets an AI assistant work in your TIA Portal project, so every change stays under your control. This page describes what the program does on your workstation, what it never does, and what the account and licence server receives and stores.

On Your Workstation

Confirmation in the terminal

Every call that would change the project shows a confirmation in the terminal with the objects it touches
Allow Once runs it, Skip cancels it; without your answer nothing changes
Without the terminal, such a call is refused
Every call of the assistant appears in the terminal live, with its duration

Passwords never reach the assistant

Where a change needs a password, you type it into a masked field of the terminal
The password goes to TIA Portal only and never reaches the assistant, the activity list or the log files
Reading the project security never shows a password
Credentials of HMI connections are shown masked, and a call that names one is refused

Files only in fixed folders

Files are written only into:

your Documents, Desktop and OneDrive
the temporary folder
the export folder and the working folder
the folder of the open project, but never into the folders TIA Portal manages there

A file that is only read, such as an import file, may lie in any local folder.

Saving only on confirmation

The project is saved only when you confirm a save, or an archive, which saves the project first and says so
Closing a project, switching to another project or instance and ending the connection never save
A project protected by user management opens after you type its user name and password in the terminal

Safety program

The assistant never logs in to the safety program: you log in to it in TIA Portal yourself. Safety passwords are typed only into the masked fields of the terminal.

Your project stays local

TIA Openness Manager MCP runs on your workstation and works with the TIA Portal installed there. It sends no project data to our servers. What your AI assistant does with the answers it reads depends on the assistant you use and its provider.

Account and Licence Server

What the licence server receives

For the licence check the program sends:

your account e-mail address
an identifier of your device for the device binding
the state of your licence or trial

No engineering data, no project metadata, no file names.

Verification guarantees:

Licence responses are digitally signed; a changed or forged response is rejected before it is trusted
A licence response is checked against the device binding, so it cannot be reused on another device
Rate limiting protects the server against probing

Account system: authentication and web portal

Passwordless sign-in: a 6-digit one-time code by e-mail (single use, 15 minutes valid, stored only in encrypted form). There is no password that could be phished or leaked
Session protection: on suspected token theft, all sessions of the account are revoked
Origin protection on all sign-in endpoints prevents cross-site calls from other domains
Device releases are limited per 30 days as protection against licence sharing

Data location

The account and licence server runs in the EU. Account data does not leave the European jurisdiction.

Stored on the server: your e-mail address, the subscription or trial status and the device binding. Payment data is held by the payment provider, not by us.

See the Privacy Policy for the formal data-protection notice.

Questions?

For questions about data handling, the account server or compliance:

Email: support@tiaopenessmanager.ch

See also our Legal Notice for provider information.