Security and Production Deployment

- Bind gRPC to loopback by default.

- Use host firewall rules and an isolated test network for remote access.

- Store licenses, private keys, and trust anchors under restricted ACLs.

- Never place private keys in profile YAML or evidence bundles.

- Use production-issued certificates and strict trust validation for PnC/TLS.

- Run services with a dedicated, least-privilege service identity.

- Preserve signed artifacts and audit logs according to your quality system.

- Keep NI, Windows, drivers, and ChargeLink on qualified versions.

Example ACL restriction:

icacls C:\ChargeLinkData\pki /inheritance:r
icacls C:\ChargeLinkData\pki /grant:r 'Administrators:(OI)(CI)F' 'SYSTEM:(OI)(CI)F'

Do not expose the gRPC, REST, or OPC UA endpoints to an untrusted network without the security controls supplied for your edition.