Production tracker security checklist

• Every row is scoped by org and site; roles limit who can release orders, edit BOMs, place or release holds and disposition NCRs; operators can only report against work centers assigned to their session.

• Regulated approvals (BOM release, hold release, NCR disposition, CAPA closure) require re-authentication and write a signature record with the meaning and the signed content hash; records are immutable after signing.
• Released BOM/routing versions, operation reports, stock moves, genealogy edges and audit rows are insert only; corrections are new reversing rows with reasons.

• Device keys are generated once, shown once, stored hashed, scoped to one site and revocable; batches are signed with a timestamp and rejected when replayed or out of tolerance; the endpoint can never send commands to machinery.

• Operator identity and badge ids are personal data: PIN hashes use a slow hash, badge ids are stored hashed, shift reports for works councils can be pseudonymised, and logs carry operator ids not names.

• Drawings, certificates of analysis and inspection photos are type- and size-validated, scanned, stored under non-guessable keys and served by signed URLs.

• The system is not a safety system: no interlocks, no e-stops and no control outputs; UI copy states that production decisions remain with qualified personnel.

• ISO 9001 and IATF 16949 quality records (applies to certified manufacturers): Controlled documents, nonconformance and corrective action records, calibration and traceability evidence are audited; the app stores and reports them and does not certify a quality system.
• FDA 21 CFR Part 11 and EU Annex 11 (applies to pharma, medical device, food): Electronic records and signatures need audit trails, unique signers, re-authentication and validated systems; the app provides the technical controls, validation is the operator's responsibility.
• GMP batch records and recall readiness (applies to regulated products): Batch genealogy must support forward and backward trace within hours; keep consumption and shipment edges for the product lifetime plus retention.
• Works councils and operator monitoring (applies to EU workforce): Individual productivity tracking can be restricted (for example in Germany and France); pseudonymise operator data in reports by default.
• Machine safety and industrial cybersecurity (applies to device connectivity): Control and safety functions fall under machinery safety rules and IEC 62443; this software is read-only against machines and must sit behind a DMZ gateway.

• device ingest rows per day: hard per-tenant ceiling on stored readings per day; over the limit batches are rejected with 429, never queued.
• batch record pdfs per site month: capped PDF renders per site per month.
• storage gb per org: per-tenant quota for drawings, photos and reports.

Forge64 gives every app its own Postgres database and runs a quality gate that flags unauthenticated writes and secrets in client code before you see the app. It does not replace your own testing, and it holds no third-party security certification today.

This is a reference design for the category, not a promise that every item is generated today. Built-ins such as background jobs, file uploads and search are rolling out; email sent from your app is coming soon, so anything here that needs it is something you add yourself for now.

• Sign in as two different users and try to open each other's records by changing the id in the address.
• Submit each form with an empty value, a very long value and a script tag, and check the result.
• Call each write endpoint without signing in and check that it refuses.

What is the biggest security risk in a production tracker?

Every row is scoped by org and site; roles limit who can release orders, edit BOMs, place or release holds and disposition NCRs; operators can only report against work centers assigned to their session.

Does a production tracker have compliance obligations?

ISO 9001 and IATF 16949 quality records, if you have certified manufacturers: Controlled documents, nonconformance and corrective action records, calibration and traceability evidence are audited; the app stores and reports them and does not certify a quality system. This is a starting point, not legal advice.

Will Forge64 certify my app as secure?

No. Forge64 holds no third-party security certification today and does not certify apps. The checklist is a way to test your own app.

• How to build a production tracker
• Production tracker architecture
• Example prompt for a production tracker
• Production tracker scaling checklist
• Often combined: inventory system
• Often combined: approval workflow app
• All app types