RTLS that IT and OT can both own.

RTLS deployments fail security review when they are treated as IT projects rather than OT projects.

The right starting point is a Purdue-model-aware architecture: where do the anchors, gateways and middleware sit? Which zone? What conduits? Modern RTLS platforms support IEC 62443-aligned segmentation,

mutual TLS, role-based access and audit logging — but only when designed in from gate 1.

Retro-fitting security after the architecture is signed costs more than redesigning.

Location data is sensitive by design: it can identify staff, expose process knowledge, and create regulatory exposure (GDPR, works-council).

The right control plane segregates raw position telemetry from derived analytics, applies role-based access at the API layer, and logs every query. The default settings on most vendor platforms are wrong for European enterprise contexts — they need explicit tuning.

Three integration patterns work at enterprise scale: streaming (MQTT or Kafka for high-frequency position events into a digital twin or analytics layer),

API-driven (REST or gRPC for the WMS, MES or EMR to pull location on demand), and ESB-mediated (where you already run an enterprise service bus, MuleSoft, Boomi).

The wrong pattern locks you into the vendor's data model. We design for the pattern your stack already uses.

Modern procurement requires SBOM, SOC 2 or ISO 27001 attestation, and patch-management commitments from RTLS suppliers. Not all vendors meet that bar — and the ones that do are not always the technically-strongest.

We run vendor scrutiny against your specific security posture (often with your CISO directly) and produce a scorecard that survives third-party-risk review.

IT and OT jointly own whether locating stays maintainable. Criteria:

• Shared RACI — who patches gateways, who owns certificates, who approves change windows.
• Segmentation first — dedicated paths where risk demands; BLE/Wi-Fi riding existing gear only with explicit risk acceptance.
• Integration patterns that scale — normalized location events into MES/WMS/ERP/EHS via APIs or brokers, not one-off scripts.
• Exit pack — credentials, as-builts, tag registries and data exports remain yours.

Vendors pitch single-pane platforms. SIs pitch turnkey installs. Enterprise architects should buy a locating data layer that can survive a hardware swap.

• Unclear ownership between IT networking and OT engineering after go-live.
• Point integrations that break on vendor version upgrades.
• Spectrum and channel plans ignored until production interference appears.
• Identity tied to vendor cloud tenancy with no enterprise IdP.
• No capacity model for tag and event growth across sites.

• Document the reference architecture for our Purdue zones and identity provider.
• Which open protocols and export formats do we get on day one?
• Who supports firmware, certificates and reader health after warranty — named SLA?
• How do you deduplicate and time-order events before they hit MES/WMS?
• What is the migration path if we change radio vendors in year three?

TRACIO delivers buyer-side architecture and programme governance for locating — RF survey, segmentation, integration design and vendor scrutiny — without a hardware or platform SKU. We keep both sides of the IT/OT split in a single RACI the steering group can audit.

IT and OT jointly own whether locating stays maintainable. Criteria:

• Shared RACI — who patches gateways, who owns certificates, who approves change windows.
• Segmentation first — dedicated paths where risk demands; BLE/Wi-Fi riding existing gear only with explicit risk acceptance.
• Integration patterns that scale — normalized location events into MES/WMS/ERP/EHS via APIs or brokers, not one-off scripts.
• Exit pack — credentials, as-builts, tag registries and data exports remain yours.

Vendors pitch single-pane platforms. SIs pitch turnkey installs. Enterprise architects should buy a locating data layer that can survive a hardware swap.

• Unclear ownership between IT networking and OT engineering after go-live.
• Point integrations that break on vendor version upgrades.
• Spectrum and channel plans ignored until production interference appears.
• Identity tied to vendor cloud tenancy with no enterprise IdP.
• No capacity model for tag and event growth across sites.

• Document the reference architecture for our Purdue zones and identity provider.
• Which open protocols and export formats do we get on day one?
• Who supports firmware, certificates and reader health after warranty — named SLA?
• How do you deduplicate and time-order events before they hit MES/WMS?
• What is the migration path if we change radio vendors in year three?

TRACIO delivers buyer-side architecture and programme governance for locating — RF survey, segmentation, integration design and vendor scrutiny — without a hardware or platform SKU. We keep both sides of the IT/OT split in a single RACI the steering group can audit.