Ewon vs IronFlock: Remote Access & Machine Data (2026)
Ewon, by HMS Networks (Sweden), is one of the most established names in industrial remote access. The model: an Ewon VPN gateway — the Cosy+ for pure remote access or the Flexy for remote access plus data logging — connects outbound to the Talk2m cloud, and engineers reach the machine LAN through the eCatcher VPN client or the M2Web browser portal. Originally Belgian (founded 2001, acquired by HMS in 2016), Ewon has connected over 400,000 machines through Talk2m. In 2024/25 HMS launched a parallel next-generation stack — Ewon Edge gateways with the new Ewon Cloud — aimed at larger machine fleets. Teams looking for an Ewon alternative usually want the proven remote access plus modern fleet data, dashboards, and edge computing in one platform.
IronFlock is a vendor-neutral distributed system: autonomous edge devices running containerized apps on any Linux or Windows hardware, connected to central services (FleetDB, AI orchestration, dashboarding) through a real-time WAMP message broker.
Both systems give service teams secure access to machines behind customer firewalls without inbound ports, and both can collect machine data. The key differences are in what happens with that data, whether the edge can run real applications, hardware freedom, and how the offering is priced.
This page provides an honest comparison to help teams choose the right system.
At a Glance
| Dimension | IronFlock | Ewon (HMS Networks) |
|---|---|---|
| Look & feel | Modern web UI — clean, responsive, browser-native | eCatcher desktop client + M2Web portal — functional, service-technician-oriented; new Ewon Cloud modernizes this for Edge gateways |
| Usability | Self-service: sign up, flash a device, deploy apps in minutes | Very simple commissioning — gateway registration wizard in minutes, “electrician-friendly” |
| Collaboration | Multi-user with roles, API keys, device sharing, project-level access control | Talk2m user groups, device pools, temporary users (Pro plan); per-user 2FA |
| How modern | Cloud-native, containerized, AI-first, designed 2020s | Proven 2000s-era VPN architecture; next-gen Ewon Cloud (2024) available for new Edge gateways only |
| Community | Growing — open app marketplace, developer docs | Very large installed base — 400,000+ machines on Talk2m, global distributor network |
| Strategy | Open ecosystem — IronFlock builds the core system (data historian, alarms, dashboards, device management) and extends via an open third-party app marketplace | Hardware-led — HMS sells gateways through distributors; cloud services support the hardware business |
| Tradition | Founded for IoT fleet management and edge computing | HMS Networks — industrial networking since 1988 (Anybus, Ewon, Red Lion brands), Nasdaq Stockholm listed |
Architecture
Ewon: VPN Gateway + Talk2m Cloud
The Ewon architecture is a hardware VPN gateway connected to a managed relay cloud:
-
Gateways: The Cosy+ provides remote access only. The Flexy 205 adds data logging — up to 2,500 tags polled from PLCs via an unusually broad protocol set (Siemens S7/MPI, Rockwell DF1/EtherNet/IP, Modbus, Omron FINS, Mitsubishi MELSEC, OPC UA, BACnet/IP and more), with local historical storage of up to 1,000,000 timestamps. The new Ewon Edge 310/410 series targets medium-to-large fleets and connects exclusively to the new Ewon Cloud.
-
Talk2m cloud: Gateways connect outbound via OpenVPN. Engineers use eCatcher (Windows VPN client, plus iOS/Android apps) for full VPN to the machine LAN, or M2Web in the browser for HTTP, VNC, and RDP access. USB over IP lets USB-connected devices appear locally on the engineer’s PC.
-
Data path: The Flexy pushes historical data to DataMailbox — a cloud buffer that retains datapoints for a maximum of 10 days. Long-term storage and analytics are the customer’s job: third-party systems pull from the DMWeb API. Dashboarding is limited — M2Web shows up to 6 KPIs per machine, and the Talk2m “visualization” option (Pro plan) is positioned by HMS as an entry-level IIoT solution. viewON lets you design HMI pages served from the Flexy itself.
-
Custom logic: The Flexy runs BASIC scripts and Java (a J2SE 1.4-level embedded JVM) — no containers.
-
Hardware: Ewon gateways (Cosy, Flexy, Edge), sold via distributors
-
Remote access: eCatcher VPN, M2Web browser (HTTP/VNC/RDP), USB over IP
-
Cloud: HMS-operated Talk2m (or new Ewon Cloud for Edge gateways); no self-hosted option
-
Security: ISO 27001 (cloud and gateways in scope), IEC 62443 assessment for Cosy+, EAL6+ secure element, per-user 2FA
IronFlock: Distributed Edge + Central Services
IronFlock is a distributed system with two complementary layers. Autonomous edge devices run a lightweight agent and Docker-containerized apps at the point of operation. Central services — FleetDB (TimescaleDB), the FleetDB Service, AI orchestration, and the web UI — provide fleet-wide data storage, dashboarding, and intelligence. A WAMP message broker connects everything with real-time pub/sub and RPC.
You can also provision virtual devices — cloud-hosted compute nodes that join your project alongside physical devices, running fleet-wide services like Grafana, Node-RED, Jupyter, or custom data pipelines.
- Edge devices: Any Linux- or Windows-capable hardware — Raspberry Pi, industrial PCs, NVIDIA Jetson, Windows IPCs, existing gateways — running apps autonomously (on Windows, the agent runs as a native service with automatic restart and self-update)
- Apps: Docker containers in any programming language, deployed to edge or virtual devices
- Data: Edge apps publish telemetry through the message broker to FleetDB, which automatically provisions per-project TimescaleDB tables — permanent, SQL-queryable storage with no retention cliff
- Remote access: Managed reverse-proxy tunnels for HTTP(S), TCP, and UDP — HMIs, VNC, SSH, PLC programming — plus browser-based root host access
- Deployment: Cloud SaaS or on-premises, including air-gapped setups
What This Means in Practice
| Scenario | IronFlock | Ewon |
|---|---|---|
| Service engineer reaches a machine | Click “Open Tunnel” in the browser — no client install | ✅ eCatcher VPN (Windows) or M2Web browser access |
| Program a PLC remotely | TCP tunnel to TIA Portal, CODESYS, TwinCAT — or full VPN via the WireGuard app | ✅ Full VPN to the machine LAN — the classic Ewon workflow |
| Access a USB-only device remotely | ⚠️ Via a containerized bridge app | ✅ USB over IP through Talk2m |
| Keep 5 years of machine history | ✅ Per-project TimescaleDB, no retention limit | ❌ DataMailbox buffers 10 days — build storage on a third-party cloud |
| Build a fleet dashboard | ✅ Built-in no-code dashboard builder | ⚠️ 6 KPIs per machine in M2Web; visualization add-on on Pro plan |
| Run custom analytics at the edge | ✅ Docker apps in any language on any device | ⚠️ BASIC / Java 1.4 scripting on Flexy |
| Query data with natural language | ✅ Built-in AI with multi-agent orchestration | ❌ Not available |
| Update 100 devices | One-click bulk OTA across the fleet (OS, agent, and apps) | ⚠️ Remote firmware management for Cosy+ on Pro plan; Edge fleet management in new Ewon Cloud |
| Add a machine that already has an IPC (Windows or Linux) | Install the agent — no extra hardware | Purchase and wire an Ewon gateway |
| Self-host the platform | ✅ On-premises subscription | ❌ Talk2m is HMS-operated only |
Feature Comparison
Data & Connectivity
| Feature | IronFlock | Ewon |
|---|---|---|
| PLC connectivity | ✅ Industrial Collector — Modbus TCP/RTU, OPC UA, Siemens S7 and Allen-Bradley in one app, with a catalog of pre-mapped equipment profiles (S7 and Allen-Bradley in early access); plus IO-Link, BACnet and MTConnect collectors | ✅ Flexy: exceptionally broad — S7, MPI, DF1, EtherNet/IP, Modbus, FINS, MELSEC, OPC UA, BACnet/IP |
| Tag capacity | ✅ No fixed tag limit — data model defined per app | ⚠️ Up to 2,500 tags per Flexy |
| Long-term time-series storage | ✅ Per-project TimescaleDB (auto-provisioned), direct SQL access | ❌ Flexy: 1M timestamps local; DataMailbox: 10-day cloud buffer |
| Data API | ✅ REST API + SQL + real-time subscriptions | ✅ DMWeb API (pull from DataMailbox) |
| MQTT support | ✅ Via apps | ✅ Flexy MQTT northbound (via scripting) |
| Offline buffering | ✅ Devices operate fully autonomously, sync on reconnect | ✅ Flexy local historical logging |
| Data isolation between projects | ✅ Physical database separation + cryptographic isolation | ⚠️ Talk2m account separation |
| LoRaWAN sensor integration | ✅ ChirpStack on virtual device | ❌ Not offered |
Visualization & Dashboards
| Feature | IronFlock | Ewon |
|---|---|---|
| Dashboard builder | ✅ No-code widget system in the browser | ⚠️ Talk2m visualization (Pro plan) — entry-level; M2Web shows up to 6 KPIs per machine |
| Widget library | ✅ Charts, gauges, maps, tables, forms, actions | ⚠️ Limited — no published widget catalog |
| Industrial HMI graphics (P&ID) | ✅ Full SCADA symbol library | ⚠️ viewON HMI pages served from the Flexy |
| Real-time updates | ✅ Sub-second via WAMP | ⚠️ Polling-based |
| Multi-page dashboards | ✅ | ⚠️ viewON per-gateway pages |
| Embeddable dashboards | ✅ | ❌ |
| Map view of fleet | ✅ | ✅ eCatcher map view |
Remote Access & Security
| Feature | IronFlock | Ewon |
|---|---|---|
| Browser-based access (no client install) | ✅ HTTP(S), VNC, SSH tunnels from the browser | ✅ M2Web — HTTP, VNC, RDP |
| Full VPN to machine LAN | ✅ WireGuard app — install on any project, VPN to selected gateways; third parties can offer additional VPN apps | ✅ eCatcher OpenVPN — the industry-classic workflow |
| USB over IP | ❌ | ✅ Via Talk2m |
| SSH / host terminal | ✅ Browser-based root host access | ⚠️ Via VPN to devices on the LAN |
| Mobile access | ✅ Responsive web UI | ✅ eCatcher iOS/Android apps, M2Web |
| Authentication | ✅ OIDC with TOTP 2FA | ✅ Per-user 2FA (SMS OTP), x509 device certificates |
| Zero open ports on devices | ✅ Agent calls out | ✅ Gateway connects outbound |
| Audit logging | ✅ Full device and user audit trail | ⚠️ Connection logs; full audit logs in new Ewon Cloud |
| Security certifications | ⚠️ Architecture designed for IEC 62443 / ISO 27001 / SOC 2 compliance | ✅ ISO 27001 (cloud + gateways), IEC 62443 assessment (Cosy+), EAL6+ secure element |
| Self-hosted option | ✅ On-premises deployment | ❌ No self-hosted Talk2m (third-party OpenVPN servers only, losing Talk2m features) |
App Development
| Feature | IronFlock | Ewon |
|---|---|---|
| Custom edge apps | ✅ Docker containers in any language, on any device | ⚠️ BASIC scripting + embedded Java (J2SE 1.4) on Flexy |
| Modern language support | ✅ Python, Go, Rust, JS, C++ — anything that runs in a container | ❌ BASIC and legacy Java only |
| Built-in cloud IDE | ✅ | ❌ Eclipse-based local toolchain |
| Git integration + CI/CD | ✅ GitHub, GitLab, built-in build and release | ❌ |
| App marketplace | ✅ Open — publish freely, with monetization | ❌ Open-source connectors on GitHub |
| REST API | ✅ Full REST API + Python/JS SDKs | ✅ DMWeb API, M2Web API |
AI & Analytics
| Feature | IronFlock | Ewon |
|---|---|---|
| Multi-agent AI orchestration | ✅ Built-in | ❌ Not available |
| Natural language queries over device data | ✅ | ❌ |
| Physical AI (execute functions on devices) | ✅ | ❌ |
| Edge ML inference | ✅ Via containerized apps (PyTorch, TensorFlow, ONNX) | ❌ Not feasible in BASIC/Java 1.4 environment |
| Cloud analytics | ✅ Built-in via FleetDB + AI Service | ❌ Via third-party platforms pulling from DataMailbox |
Device & Fleet Management
| Feature | IronFlock | Ewon |
|---|---|---|
| Bulk OTA updates (OS, agent, apps) | ✅ | ⚠️ Cosy+ firmware via Talk2m Pro; Edge fleet provisioning in new Ewon Cloud |
| Full OS control on the edge | ✅ Any Linux distribution (root access) or Windows | ❌ Closed gateway firmware |
| Device grouping and management | ✅ Device groups, settings, resilience | ✅ Device pools (Pro plan) |
| Live logs from all apps | ✅ Streaming in browser | ⚠️ Gateway diagnostics |
| Virtual devices (cloud compute) | ✅ Run Grafana, Node-RED, Jupyter alongside physical fleet | ❌ |
| Connect any Linux or Windows device | ✅ ARM, x86, NVIDIA Jetson, Windows IPCs, any SBC | ❌ Ewon gateways only |
| Platform generations | ✅ One platform for all devices | ⚠️ Two parallel stacks: Talk2m (Cosy/Flexy) and Ewon Cloud (Edge only) |
Alarms & Notifications
| Feature | IronFlock | Ewon |
|---|---|---|
| Configurable alarm rules | ✅ On any telemetry stream | ✅ Per-tag alarms on Flexy (ALM/ACK/RTN/END states) |
| Email notifications | ✅ | ✅ Free via Talk2m SMTP relay |
| SMS notifications | ✅ Built-in | ⚠️ Chargeable — 50/month on Light/Pro, none on Free |
| Severity levels | ✅ Critical, Major, Minor | ⚠️ Tag alarm states |
| Auto-resolve | ✅ | ⚠️ Return-to-normal state per tag |
| Fleet-wide alarm overview | ✅ | ⚠️ Per-machine notification checkbox in M2Web |
Pricing Comparison
Ewon: Hardware via Distributors + Talk2m Credit Plans
Ewon’s model combines gateway hardware with cloud subscription tiers (no prices published — orders go through distributors or HMS offices):
- Hardware: Every machine needs an Ewon gateway (Cosy+, Flexy, or Edge), purchased through the distributor channel. List prices are not published.
- Talk2m Free: 1 concurrent VPN connection, 3 GB VPN traffic/month, 5M DataMailbox datapoints/month, no SMS — and now limited to 12 months per added device.
- Talk2m Light / Pro: More concurrent connections and traffic, 50 SMS/month, SLA; Pro adds user groups, device pools, temporary users, visualization, and remote firmware management. Billing runs on a credit system with overage charges per GB of VPN traffic, per million datapoints, and per SMS.
- Ewon Cloud: The new platform for Edge gateways is priced separately.
- Long-term data storage and real dashboards typically require a third-party IIoT platform consuming the DMWeb API — an additional cost layer to factor in.
IronFlock: Free Cloud + Subscription for On-Premises
IronFlock’s cloud version is free — all core features (device management, dashboards, data storage, OTA updates, alarms, remote access, app deployment) are included at no cost, with no 12-month clock. IronFlock charges based on resource usage: storage, remote access sessions, virtual devices, and AI usage. There is no per-device cloud plan and no VPN traffic metering. See the pricing page for details.
Hardware is not constrained — any Linux or Windows device works, and machines that already contain an industrial PC need no additional gateway.
Additional capabilities can be added by purchasing apps from the marketplace — built by IronFlock or third-party developers.
For on-premises deployments (air-gapped or private infrastructure), IronFlock offers a subscription-based license.
When to Choose Ewon
Ewon may be the better choice if:
- Your service workflow is built on full VPN into the machine LAN — eCatcher plus Talk2m is the industry-classic, IT-accepted way to do exactly that, with a published SLA on the Pro plan.
- You need USB over IP or access to serial-era equipment — Ewon covers device classes that Ethernet-only approaches miss.
- You want a proven, massive installed base — 400,000+ connected machines and two decades of distributor support mean your integrator almost certainly knows Ewon.
- You need exotic legacy PLC protocols — the Flexy’s native protocol list (MPI, PPI, DF1, FINS, MELSEC FX and more) is one of the broadest available in a data gateway.
- Your security review requires audited certifications today — ISO 27001 covering both cloud and gateways, IEC 62443 assessment, and an EAL6+ secure element in the Cosy+.
- You prefer fully vendor-managed gateways — hardware, firmware, and cloud from one supplier through an established distributor channel.
When to Choose IronFlock as an Ewon Alternative
IronFlock is the stronger choice when:
- You want to own your machine data long-term — per-project TimescaleDB with SQL access instead of a 10-day DataMailbox buffer feeding a third-party platform you also have to pay for.
- You need real dashboards — a no-code builder with charts, gauges, maps, forms, and SCADA symbols, not 6 KPIs per machine or an entry-level visualization add-on.
- You need modern edge computing — Docker apps in Python, Go, or any language, not BASIC scripts and a Java 1.4 runtime.
- You need built-in AI — natural language queries, multi-agent orchestration, physical AI execution on devices.
- You want hardware freedom — machines with an existing Windows or Linux IPC, Jetson, or embedded board join the fleet without buying a gateway per machine; Windows devices are first-class citizens, with the agent running as a native Windows service.
- You want one platform, not two generations — IronFlock avoids the Talk2m vs. Ewon Cloud split; every device runs the same stack.
- You need fleet-wide OTA — OS, agent, and app updates across all devices, not firmware updates gated by plan tier and gateway model.
- You want VPN as an open capability — the WireGuard app installs on any project for full VPN to selected gateways (modern WireGuard instead of OpenVPN), and the open marketplace lets third parties offer additional VPN solutions.
- Predictable pricing matters — a free cloud tier without a 12-month expiry, no VPN traffic credits, no per-datapoint metering, and transparent resource pricing.
- You are an OEM building digital services — package monitoring, analytics, and AI as sellable apps with per-customer data isolation.
Migration Path
IronFlock can run alongside Ewon. Many teams keep eCatcher-based VPN service workflows running while installing IronFlock’s agent on machines (or their industrial PCs) to add permanent data storage, fleet dashboards, and alarms — the layer that DataMailbox’s 10-day buffer was never designed to provide. A Flexy’s MQTT northbound can even publish into an IronFlock pipeline during the transition. As confidence grows, remote service shifts to IronFlock’s browser-based tunnels, and new machine generations ship without a dedicated VPN gateway.
Ready to try it? Start free — connect a device and see your first dashboard in minutes.