IXON vs IronFlock: Remote Access & IIoT Compared (2026)
IXON Cloud is an industrial IoT platform from IXON B.V. (Netherlands), built for machine builders who want remote access and machine data services without running their own infrastructure. The portfolio combines cloud products — Remote Access Cloud, Machine Insights Cloud, and Service Portal Cloud — with IXON’s own edge gateway hardware: the IXrouter3, SecureEdge, and SecureEdge Pro, plus the IXagent software agent for Windows, Debian, and Raspberry Pi OS. Founded in 2014, IXON reports over 100,000 connected machines and 2,500+ machine-builder customers. Teams evaluating an IXON alternative usually want the same self-service remote access with more freedom on hardware, edge computing, and data ownership.
IronFlock is a vendor-neutral distributed system: autonomous edge devices running containerized apps on any Linux or Windows hardware, connected to central services (FleetDB, AI orchestration, dashboarding) through a real-time WAMP message broker.
Both platforms target OEM machine builders, both offer browser-based remote access without customer-side VPN configuration, and both provide cloud data logging and dashboards. The key differences are in hardware openness, edge computing capabilities, AI, self-hosting, and how the pricing scales.
This page provides an honest comparison to help teams choose the right system.
At a Glance
| Dimension | IronFlock | IXON |
|---|---|---|
| Look & feel | Modern web UI — clean, responsive, browser-native | Modern web UI — polished SaaS portal (IXON Studio), white-label options |
| Usability | Self-service: sign up, flash a device, deploy apps in minutes | Self-service: buy an IXrouter or install IXagent, claim it in IXON Cloud, connect in minutes |
| Collaboration | Multi-user with roles, API keys, device sharing, project-level access control | Multi-user with roles, groups, access profiles, temporary access — unlimited users on all plans |
| How modern | Cloud-native, containerized, AI-first, designed 2020s | Cloud-native SaaS, API-first, designed 2010s–2020s |
| Community | Growing — open app marketplace, developer docs | 2,500+ machine builders, IXON Marketplace with 50+ apps, developer portal |
| Strategy | Open ecosystem — IronFlock builds the core system (data historian, alarms, dashboards, device management) and extends via an open third-party app marketplace | Product suite — IXON builds the cloud products and gateway hardware; extensions via App Engine and a curated marketplace |
| Tradition | Founded for IoT fleet management and edge computing | Founded 2014 in the Netherlands for machine-builder remote access, grown into an IIoT suite |
Architecture
IXON: Gateway Hardware + Managed Cloud Suite
IXON’s architecture pairs proprietary edge gateways with a fully managed cloud:
-
Edge gateways: The IXrouter3 (Ethernet, 4G, Wi-Fi variants) handles remote access and data logging. The newer SecureEdge line adds hardened security, and the SecureEdge Pro (ARM quad-core, NPU, TPM) is the only model that runs custom Docker applications. The IXagent software agent covers Windows, Debian, Raspberry Pi OS, and Docker hosts for access without an IXON gateway.
-
IXON Cloud: A managed SaaS running on 150+ servers at public cloud providers (DigitalOcean, Vultr, UpCloud and others), with data stored in the EU. Gateways connect outbound to VPN servers; a built-in firewall separates the machine network from the factory network. There is no self-hosted version of the platform.
-
Data pipeline: Gateways read PLC data via Siemens S7, OPC UA, Modbus TCP, EtherNet/IP, MELSEC, or BACnet/IP, buffer locally (8 GB on IXrouter3), and log to IXON’s managed time-series (“Metrics”) and JSON storage. Data can also be streamed to your own MQTT broker (Azure IoT Hub, AWS IoT Core, Mosquitto) at no extra cost.
-
Apps: The IXON Marketplace offers 50+ apps (Grafana, Node-RED, TensorFlow-based ML, intrusion detection) — deployable to SecureEdge Pro devices. Custom cloud extensions are built with the App Engine (UI components and cloud functions).
-
Hardware: IXON gateways or IXagent on Windows/Debian/Raspberry Pi OS
-
Remote access: DirectVPN (browser-based VPN), EasyControl (VNC/HTTP), RDP and SSH via paid StationAccess add-ons, RTSP camera LiveView
-
Cloud: IXON-hosted SaaS only, EU data storage
-
Integration: REST API, VPN Client API, webhooks, MQTT export, SSO
IronFlock: Distributed Edge + Central Services
IronFlock is a distributed system with two complementary layers. Autonomous edge devices run a lightweight agent and Docker-containerized apps at the point of operation. Central services — FleetDB (TimescaleDB), the FleetDB Service, AI orchestration, and the web UI — provide fleet-wide data storage, dashboarding, and intelligence. A WAMP message broker connects everything with real-time pub/sub and RPC.
You can also provision virtual devices — cloud-hosted compute nodes that join your project alongside physical devices, running fleet-wide services like Grafana, Node-RED, Jupyter, or custom data pipelines.
- Edge devices: Any Linux- or Windows-capable hardware — Raspberry Pi, industrial PCs, NVIDIA Jetson, Windows IPCs, existing gateways — running apps autonomously (on Windows, the agent runs as a native service with automatic restart and self-update)
- Apps: Docker containers in any programming language, deployed to edge or virtual devices on any device class
- Data: Edge apps publish telemetry through the message broker to FleetDB, which automatically provisions per-project TimescaleDB tables you can query with SQL
- Central services: FleetDB Service processes data streams, evaluates alarms, and serves dashboards; the AI Service orchestrates multi-agent conversations with direct device access
- Deployment: Cloud SaaS or on-premises — the full platform can run in your own infrastructure
What This Means in Practice
| Scenario | IronFlock | IXON |
|---|---|---|
| Add a new machine | Install the agent on any Linux or Windows device the machine already has — or add one | Install an IXrouter/SecureEdge gateway or IXagent (Windows/Debian/RPi) |
| Use existing industrial PCs / Jetson | ✅ Any Linux or Windows device joins the fleet as a first-class citizen | ⚠️ IXagent covers Windows, Debian, Raspberry Pi OS; no arbitrary embedded Linux |
| Run custom edge apps | ✅ Docker apps on every device | ⚠️ Docker apps on SecureEdge Pro only |
| Access a machine HMI remotely | Click “Open Tunnel” in the browser — HTTP, VNC, SSH, TCP | ✅ EasyControl (VNC/HTTP) in the browser |
| Program a PLC remotely | TCP tunnel to TIA Portal, CODESYS, TwinCAT — or full VPN via the WireGuard app | ✅ DirectVPN from the browser |
| Query fleet data with SQL | ✅ Per-project TimescaleDB | ⚠️ Managed storage, accessed via IXON Studio and APIs |
| Query data with natural language | ✅ Built-in AI with multi-agent orchestration | ❌ Not available |
| Update 100 devices | One-click bulk OTA across the fleet (OS, agent, and apps) | Gateway firmware updates via IXON Cloud; apps to SecureEdge Pro fleet |
| Self-host the platform | ✅ On-premises subscription | ❌ IXON-hosted SaaS only |
| White-label portal for customers | ✅ Per-customer data isolation, embeddable dashboards | ✅ Service Portal Cloud — custom domain, branding, store-published mobile app |
Feature Comparison
Data & Connectivity
| Feature | IronFlock | IXON |
|---|---|---|
| PLC connectivity | ✅ Industrial Collector — Modbus TCP/RTU, OPC UA, Siemens S7 and Allen-Bradley in one app, with a catalog of pre-mapped equipment profiles (S7 and Allen-Bradley in early access); plus IO-Link, BACnet and MTConnect collectors | ✅ Built-in data sources: S7, OPC UA, Modbus TCP, EtherNet/IP, MELSEC, BACnet/IP |
| MQTT support | ✅ Via apps | ✅ MQTT export to your own broker included free |
| Serial / legacy protocols | ✅ Modbus RTU/ASCII over RS-485/RS-232 in the Industrial Collector; anything else via containerized apps with device access | ❌ Ethernet-based data sources only — no serial documented |
| Automated time-series storage | ✅ Per-project TimescaleDB (auto-provisioned), direct SQL access | ✅ Managed Metrics + JSON storage (EU), accessed via Studio/API |
| Data isolation between projects | ✅ Physical database separation + cryptographic isolation | ⚠️ SaaS tenant separation |
| Offline buffering | ✅ Devices operate fully autonomously, sync on reconnect | ✅ Local buffering on gateway (8 GB on IXrouter3) |
| Edge data processing | ✅ Full compute on any Linux or Windows device | ⚠️ SecureEdge Pro only |
| LoRaWAN sensor integration | ✅ ChirpStack on virtual device — unified data pipeline | ❌ Not offered |
Visualization & Dashboards
| Feature | IronFlock | IXON |
|---|---|---|
| Dashboard builder | ✅ No-code widget system in the browser | ✅ Drag-and-drop dashboards in IXON Studio |
| Widget library | ✅ Charts, gauges, maps, tables, forms, actions | ⚠️ Core chart widgets; extensions via App Engine custom components |
| Industrial HMI graphics (P&ID) | ✅ Full SCADA symbol library | ❌ Not offered |
| Form widgets with data storage | ✅ Built-in | ❌ |
| Action widgets (machine control) | ✅ Built-in | ⚠️ Via custom App Engine components |
| Real-time updates | ✅ Sub-second via WAMP | ✅ Live data widgets |
| Scheduled PDF reports | ⚠️ Via apps (Grafana, custom) | ✅ Built-in email reports |
| Embeddable dashboards | ✅ | ⚠️ Via white-label Service Portal |
| White-label OEM portal | ✅ Per-customer isolated dashboards | ✅ Service Portal Cloud — custom domain, branded mobile app (€500/month) |
Remote Access & Security
| Feature | IronFlock | IXON |
|---|---|---|
| Built-in tunneling service | ✅ TCP, HTTP(S), UDP — no VPN client needed | ✅ DirectVPN, EasyControl (VNC/HTTP) from the browser |
| Full VPN to the machine network | ✅ WireGuard app — install on any project, VPN to selected gateways; the open app model lets third parties offer additional VPN solutions | ✅ DirectVPN (browser-based) |
| Remote HMI access | ✅ One-click from browser | ✅ One-click from browser |
| Remote desktop / SSH | ✅ VNC tunneling, browser-based SSH and root host access | ⚠️ RDP and SSH via StationAccess — paid add-on |
| IP camera streaming | ✅ Via tunnel (HTTP/RTSP) | ✅ LiveView — in the €300/month Plus plan |
| Authentication | ✅ OIDC with TOTP 2FA | ✅ 2FA, SSO enforcement |
| Zero open ports on devices | ✅ Agent calls out | ✅ Gateway connects outbound |
| Per-tenant message isolation | ✅ Cryptographic realm isolation | ⚠️ SaaS tenant separation |
| Audit logging | ✅ Full device and user audit trail | ✅ Audit Trail |
| Security certifications | ⚠️ Architecture designed for IEC 62443 / ISO 27001 / SOC 2 compliance; certification in progress | ✅ Certified ISO 27001, 27017, 27701, 9001, IEC 62443 (incl. 62443-4-2 hardware); NIS2 compliant |
| Self-hosted / air-gapped option | ✅ On-premises deployment | ❌ SaaS only |
App Development
| Feature | IronFlock | IXON |
|---|---|---|
| Custom edge apps | ✅ Docker containers in any language, on any device | ⚠️ Docker apps on SecureEdge Pro hardware only |
| Built-in cloud IDE | ✅ | ❌ |
| Git integration | ✅ GitHub, GitLab | ❌ |
| CI/CD release pipeline | ✅ Built-in build and release | ⚠️ Edge App Management deploys pre-built images |
| Cloud extensions | ✅ Apps bundle edge code, dashboards, data schema, AI agents | ✅ App Engine — custom UI components + cloud functions |
| App marketplace | ✅ Open — publish freely, with monetization for third-party developers | ✅ IXON Marketplace (50+ apps, curated) |
| REST API | ✅ Full REST API + Python/JS SDKs | ✅ API-first platform (API access is a paid add-on) |
AI & Analytics
| Feature | IronFlock | IXON |
|---|---|---|
| Multi-agent AI orchestration | ✅ Built-in | ❌ Not available |
| Natural language queries over device data | ✅ | ❌ |
| Physical AI (execute functions on devices) | ✅ | ❌ |
| App-defined custom AI agents | ✅ YAML-based agent templates | ❌ |
| AI-generated real-time charts | ✅ In-conversation | ❌ |
| Edge ML inference | ✅ Via containerized apps (PyTorch, TensorFlow, ONNX) on any device | ⚠️ TensorFlow marketplace app on SecureEdge Pro (with NPU) |
| Cloud analytics | ✅ Built-in via FleetDB + AI Service | ⚠️ Dashboards and reports; deeper analytics via API export |
Device & Fleet Management
| Feature | IronFlock | IXON |
|---|---|---|
| Bulk OTA updates (OS, agent, apps) | ✅ | ⚠️ Gateway firmware via IXON Cloud; no customer OS control |
| Full OS control on the edge | ✅ Any Linux distribution (root access) or Windows | ❌ Managed gateway firmware |
| Device grouping and management | ✅ Device groups, settings, resilience | ✅ Fleet manager, hierarchical groups |
| Live logs from all apps | ✅ Streaming in browser | ⚠️ Gateway diagnostics |
| Location management and map view | ✅ | ✅ Machine location cards |
| Virtual devices (cloud compute) | ✅ Run Grafana, Node-RED, Jupyter alongside physical fleet | ❌ |
| OEM device pre-registration | ✅ Plug & play | ✅ Pre-configured gateways |
| Unlimited users | ✅ | ✅ On all plans, including free |
Alarms & Notifications
| Feature | IronFlock | IXON |
|---|---|---|
| Configurable alarm rules | ✅ On any telemetry stream | ✅ Threshold alarms on logged tags |
| Email notifications | ✅ | ✅ |
| Push notifications | ⚠️ Via integrations | ✅ Mobile app push |
| SMS notifications | ✅ Built-in | ❌ Via third-party webhooks (IFTTT, PagerDuty, SIGNL4) |
| Severity levels | ✅ Critical, Major, Minor | ⚠️ Single threshold per alarm |
| Auto-resolve | ✅ | ⚠️ One-time notification per trigger |
Pricing Comparison
IXON: Free Remote Access + Subscription Products + Hardware
IXON’s pricing (published in EUR) combines hardware and cloud subscriptions:
- Remote Access Cloud Free: genuinely free — DirectVPN, EasyControl, unlimited users and machines, 2FA, SSO, MQTT export. This is a strong free tier for pure remote access.
- Remote Access Cloud Plus: €300/month, adds IP-camera LiveView.
- Machine Insights Cloud (data logging + dashboards): from €160/month (25 GB), larger tiers on request.
- Service Portal Cloud (white-labeling): €500/month.
- Add-ons on request: API access, App Engine, StationAccess (RDP/SSH), SLA, IAM integration.
- Hardware: IXrouter3, SecureEdge, and SecureEdge Pro gateways are quote-only; every connected machine needs a gateway (or IXagent license, also quote-only).
- Terms: minimum 1-year contract, quarterly or yearly billing.
Total cost scales with the number of gateways plus the subscription tiers for data, white-labeling, and add-on modules.
IronFlock: Free Cloud + Subscription for On-Premises
IronFlock’s cloud version is free — all core features (device management, dashboards, data storage, OTA updates, alarms, remote access, app deployment) are included at no cost. IronFlock charges based on resource usage: storage, remote access sessions, virtual devices, and AI usage. There is no minimum contract. See the pricing page for details.
Hardware is not constrained — any Linux or Windows device works, from Raspberry Pi boards to the industrial PCs your machines may already have. There is no mandatory gateway purchase.
Additional capabilities can be added by purchasing apps from the marketplace — built by IronFlock or third-party developers.
For on-premises deployments (air-gapped or private infrastructure), IronFlock offers a subscription-based license.
When to Choose IXON
IXON may be the better choice if:
- You want certified turnkey gateway hardware — the SecureEdge line is IEC 62443-4-2 certified with a TPM, and IXON manages the firmware lifecycle for you.
- Your security team requires formal vendor certifications today — IXON holds ISO 27001/27017/27701/9001 and IEC 62443 certificates and states NIS2 compliance.
- You need only remote access and the free Remote Access Cloud tier covers your needs — browser VPN and VNC/HTTP access with unlimited users is hard to beat at that price.
- You want a white-labeled mobile app published to the app stores under your brand — Service Portal Cloud includes this as a managed service.
- You prefer a no-code, fully managed SaaS where the vendor supplies hardware, firmware, and cloud as one supported package.
- Browser-based VPN for PLC programming is your primary workflow — DirectVPN is mature and requires no client installation.
When to Choose IronFlock as an IXON Alternative
IronFlock is the stronger choice when:
- You want to use your own hardware — machines that already contain a Windows or Linux industrial PC, Jetson, or embedded board don’t need an additional gateway box per machine.
- You need edge computing on every device — IronFlock runs Docker apps on any Linux or Windows device, not only on one premium gateway model.
- You want your data in an open database — per-project TimescaleDB with direct SQL access, not a managed store behind vendor APIs.
- You need built-in AI — natural language queries, multi-agent orchestration, physical AI execution on devices.
- You need industrial HMI graphics — the SCADA symbol library covers P&ID-style dashboards that IXON Studio does not target.
- You want self-hosting — IXON Cloud cannot be deployed on-premises; IronFlock can, including air-gapped setups.
- You want SSH and remote desktop included rather than as paid add-on modules, and root host access from the browser.
- You want VPN as an open capability — the WireGuard app installs on any project for full VPN to selected gateways, and because VPN is an app rather than a fixed platform feature, third parties can offer additional VPN solutions on the marketplace.
- You need built-in SMS alerting with severity levels and auto-resolve, without wiring up third-party webhook services.
- Pricing flexibility matters — no minimum contract term, no per-gateway hardware requirement, and data logging without a fixed monthly tier.
- You want to build and monetize apps — package your domain expertise as OEM digital services and sell them through an open marketplace.
Migration Path
IronFlock can run alongside IXON. Because IronFlock’s agent installs on any Linux or Windows device, teams typically start by adding IronFlock to machines that already have compute on board — gaining fleet dashboards, SQL-accessible telemetry, and AI on top of the existing IXON remote-access setup. IXON’s free MQTT export can even feed existing logged data into an IronFlock pipeline during the transition. Over time, IronFlock’s tunneling replaces gateway-based VPN access machine by machine, and new machine generations ship without a dedicated gateway box.
Ready to try it? Start free — connect a device and see your first dashboard in minutes.