Security & Deployment
Deploy REWO your way — on infrastructure you trust.
Shared cloud, your own cloud tenant, or fully inside your own network. Your operational knowledge stays your data — hosted in Frankfurt, under an ISO 27001-certified information security management system.
- ISO/IEC 27001 certified
- Hosted in Frankfurt, Germany
- On-premise available
- SSO · SAML 2.0 · OIDC
- AES-256 & TLS 1.3
At a glance — for IT
- Deployment
- Shared cloud · Private cloud · On-premise
- Runs on
- Any virtual machine — ours or yours
- Hosting
- Microsoft Azure — Frankfurt, Germany (EU)
- Certification
- ISO/IEC 27001
- Encryption
- AES-256 at rest · TLS 1.3 in transit
- Network
- Zero-trust, with intrusion detection
- Authentication
- SAML 2.0 · OIDC · OAuth 2.0 · AD / LDAP
- Access control
- Role- and attribute-based, scoped by site
- Integration
- REST API v2 · webhooks
- Operations
- ITIL-aligned support · uptime SLA
Deployment models
Three ways to run REWO. You pick.
Same product, same capabilities — the difference is where it runs and who operates it. Most plants start in the shared cloud; regulated and security-strict sites go private or on-premise.
Fastest to start
Shared cloud
Multi-tenant SaaS operated by REWO on Microsoft Azure in Frankfurt. Nothing to install, nothing for your team to run.
- Live in days, not quarters
- Updates and patching handled by us
- Tenant-isolated access, enforced per client
- No infrastructure cost on your side
Dedicated
Private cloud
A dedicated, single-tenant REWO instance — your own environment and database, still fully managed by us.
- No infrastructure shared with other customers
- Region chosen with you
- Can run in your own cloud tenant, on your subscription
- Customer-specific maintenance windows
Your infrastructure
On-premise
REWO runs inside your own data centre or plant network, on your servers, under your operational control — including on networks with no internet access at all.
- Data never leaves your perimeter
- Your backup, monitoring and DR policies apply
- Supports isolated / air-gapped plant networks
- Your identity provider and network rules
Also available
Bring your own Azure
REWO itself runs on any virtual machine. A few features, though, are powered by Azure services — AI-assisted guide creation, speech synthesis and transcription, media storage and automated translation — and you can point every one of them at your own Azure subscription instead of ours.
We provide your team with the full configuration requirements — services, setup steps and the network endpoints to allow.
In any of the three, REWO can run standalone — operators scan a QR code at the station, no integration required — or embedded in the systems you already run. See how integration works ↓
Data ownership & residency
It's your operational knowledge. It stays yours.
REWO holds some of the most sensitive material a manufacturer has — how your product is actually made. We treat it that way.
Hosted in Frankfurt
The REWO cloud runs on Microsoft Azure in Frankfurt, Germany — application, database and media storage alike. Your content and records do not leave the EU. For private cloud and client-managed deployments, the region is yours to choose.
Exportable, always
Instructions, media, sign-off records and audit trails can be exported — through the interface or programmatically over the API. There is no lock-in on your own content.
GDPR
REWO processes personal data — who watched, confirmed and signed — so it's built to GDPR: defined roles, purpose limitation, retention rules and deletion on request. The data processing agreement is part of your contract, not a separate negotiation.
Security & compliance
Certified, tested, and logged.
REWO is developed and operated under an ISO/IEC 27001-certified ISMS — meaning our security controls, risk management and incident handling are independently audited on an ongoing basis, not self-declared. Certificate and scope available on request.
AES-256 and TLS 1.3
Content and records are encrypted at rest with AES-256, and every connection is encrypted in transit with TLS 1.3. End to end, no exceptions.
Zero-trust network architecture
No implicit trust between components — every request is authenticated and authorised, with intrusion detection monitoring the platform continuously.
Penetration testing
The platform is subjected to regular independent penetration testing, with findings tracked to closure through our ISMS process.
Immutable version record
Version control follows immutable storage principles: revisions, approvals and electronic signatures form an unalterable record. The audit trail is designed to be evidence, not editable history.
Access logging
Administrative and user actions are logged. Who did what, and when, is answerable after the fact.
Backups & recovery
Regular automated backups with tested restore. On-premise runs under your own backup and DR policy.
Identity & access
Fits the identity stack you already run.
Single sign-on
SAML 2.0, OpenID Connect and OAuth 2.0 against your identity provider — Entra ID, Okta and equivalents. Users get in with the credentials they already have.
Active Directory / LDAP
Directory integration for on-premise and classic manufacturing IT environments, so accounts follow your existing directory.
Local accounts too
Where SSO isn't practical — shared line tablets, contractors, a plant without an IdP — REWO manages accounts itself. Both models run side by side.
Role- and attribute-based access
Permissions by role — operator, author, approver, administrator — combined with attribute-based rules, so access follows the job rather than a spreadsheet of exceptions.
Scoped by site
Each plant sees its own content; group roles see across plants. Multi-site groups get one system without every site seeing everyone else's process.
Electronic signatures
Approvals and sign-offs are captured as electronic signatures bound to the identity, the revision and the moment — the basis of the audit record.
Integration architecture
Built to sit inside your stack.
REWO is designed to live in the systems your operators already have open, rather than beside them. Here is exactly how that connection is made.
REST API (v2)
A documented, versioned REST API. External systems read guides, forms, courses and users directly from REWO. Connectors are built for your system, by us or your integrator — full API documentation available to your team.
Token-authenticated per tenant
Every request carries a bearer token validated against your tenant. API access is off by default and enabled feature by feature, so you expose only what you intend to.
Webhooks on completion
REWO pushes events out in real time — a guide finished, a form submitted and approved, a course completed — so your systems learn about it the moment it happens rather than on a nightly job.
MES
Synchronise work instructions with the manufacturing execution context, so the right guide is one click from the production order.
ERP
Push execution results back into the ERP as work is completed.
HR / LMS
Feed training and certification data into HR or learning platforms, so the competency record lives where HR expects it.
DMS / QMS
Store completed forms and approved instructions in the document system that already holds your controlled documents.
Reliability & IT footprint
What you actually have to run and support.
The short answer: a browser. REWO is designed to add as little as possible to your team's plate.
Uptime SLA
A 99.5% monthly availability target, excluding scheduled maintenance — written into your agreement, not just promised.
Browser-based, no client
Runs in a standard browser on line tablets, kiosks, phones and desktops. No software to package, deploy or update on endpoints.
Documented network requirements
If your network is restricted, we give your team the exact endpoints to allow — no guesswork, and nothing opened that doesn't need to be.
ITIL-aligned support
Incident and problem management follow ITIL-aligned service management processes, so escalation paths look familiar to your service desk.
Scales by site
Licensed per production site with unlimited users — adding operators never means an IT procurement round.
Validation documentation
For regulated environments, validation and qualification documentation is available to support your own IQ/OQ process.
Still have questions your policy needs answered?
Send them over. Our security team answers architecture, hosting and data-protection questions directly, and can share the API documentation and certification scope with your team — no sales call required to get a straight answer.