Secomea vs IronFlock: Secure Remote Access Compared (2026)
Secomea is a Danish secure remote access company (founded 2008, Copenhagen) whose solution connects service engineers to machines through a relay architecture: a SiteManager gateway at the machine, a central GateManager access server, and LinkManager clients for engineers. The current cloud platform, Secomea Prime, adds browser-first access and session monitoring on top. Secomea reports 8,000+ companies using the platform and has a strong security track record — IEC 62443-4-1 certified development, third-party audits, and Denmark’s first CVE Numbering Authority. Teams evaluating a Secomea alternative usually want the same secure machine access plus the data platform, dashboards, and edge computing that a pure remote-access solution does not provide.
IronFlock is a vendor-neutral distributed system: autonomous edge devices running containerized apps on any Linux or Windows hardware, connected to central services (FleetDB, AI orchestration, dashboarding) through a real-time WAMP message broker.
Both systems provide secure remote access to industrial equipment without inbound firewall openings, both offer granular per-user access control, and both can be self-hosted. The key differences are in scope: Secomea is focused on access management and data forwarding, while IronFlock is a full platform for edge apps, fleet data, dashboards, alarms, and AI — with remote access as one built-in capability.
This page provides an honest comparison to help teams choose the right system.
At a Glance
| Dimension | IronFlock | Secomea |
|---|---|---|
| Look & feel | Modern web UI — clean, responsive, browser-native | Secomea Prime — modern browser portal; classic GateManager console is functional but dated |
| Usability | Self-service: sign up, flash a device, deploy apps in minutes | Guided by distributors: install SiteManager, register agents per device, request access via LinkManager |
| Collaboration | Multi-user with roles, API keys, device sharing, project-level access control | Strong access workflows — request/approve, joint sessions, session recording, audit trails |
| How modern | Cloud-native, containerized, AI-first, designed 2020s | Established relay architecture (2008), modernized via Secomea Prime (2024) |
| Community | Growing — open app marketplace, developer docs | 8,000+ companies, 70+ distributors, endorsements from major PLC vendors |
| Strategy | Open ecosystem — IronFlock builds the core system (data historian, alarms, dashboards, device management) and extends via an open third-party app marketplace | Focused specialist — secure access management done deeply; data is collected and forwarded to third-party clouds |
| Tradition | Founded for IoT fleet management and edge computing | Danish security specialist — “Secure communication made easy” since 2008 |
Architecture
Secomea: SiteManager → GateManager Relay for Access Management
Secomea’s architecture has three components plus a data-forwarding module:
-
SiteManager: The gateway at the machine — hardware models (SiteManager 15xx/35xx: ARM-based, 2–4 Ethernet ports, USB and RS-232, supporting 10 or 100 device “agents”) or SiteManager Embedded, a software version for Windows, Linux, HMIs, and IPCs that can also run as a Docker container. Each PLC, HMI, or camera behind the gateway is registered as an agent, with pre-configured agent types for 50+ OT vendors (Siemens, Rockwell, Mitsubishi, Omron, Beckhoff, and more) plus generic RDP, VNC, SSH, serial, and USB agents.
-
GateManager: The central access management server — administers permissions, relays encrypted connections, and keeps audit logs. Available as Secomea-hosted (shared or private server) or self-hosted (“GateManager Own”) on your own Linux server or Azure VM.
-
LinkManager: The engineer’s client. The full VPN client is Windows-only; LinkManager Mobile and Secomea Prime provide browser-based access (RDP, VNC, SSH, Telnet, web) from any device without installation.
-
Data Collection Module (DCM): Built into SiteManager — polls machine data via OPC UA, Modbus TCP, Siemens S7, EtherNet/IP, or MQTT, aggregates it with store-and-forward buffering, and forwards it to third-party clouds: Azure IoT Hub, AWS IoT Core, Cumulocity, Aveva Insight, or any MQTT broker. Secomea itself provides no time-series storage or dashboards — analysis happens in whichever cloud you forward to.
-
Hardware: SiteManager appliances or SiteManager Embedded on your hardware
-
Access: Per-agent connections, request/approve workflows, session recording
-
Cloud: Secomea-hosted GateManager/Prime or self-hosted GateManager Own
-
Data: Collected by DCM, delivered to your separate cloud platform
IronFlock: Distributed Edge + Central Services
IronFlock is a distributed system with two complementary layers. Autonomous edge devices run a lightweight agent and Docker-containerized apps at the point of operation. Central services — FleetDB (TimescaleDB), the FleetDB Service, AI orchestration, and the web UI — provide fleet-wide data storage, dashboarding, and intelligence. A WAMP message broker connects everything with real-time pub/sub and RPC.
You can also provision virtual devices — cloud-hosted compute nodes that join your project alongside physical devices, running fleet-wide services like Grafana, Node-RED, Jupyter, or custom data pipelines.
- Edge devices: Any Linux- or Windows-capable hardware — Raspberry Pi, industrial PCs, NVIDIA Jetson, Windows IPCs, existing gateways — running apps autonomously (on Windows, the agent runs as a native service with automatic restart and self-update)
- Apps: Docker containers in any programming language, deployed to edge or virtual devices
- Data: Edge apps publish telemetry through the message broker to FleetDB, which automatically provisions per-project TimescaleDB tables you can query with SQL — no separate cloud platform needed
- Remote access: Managed reverse-proxy tunnels for HTTP(S), TCP, and UDP — HMIs, VNC, SSH, PLC programming — plus browser-based root host access
- Deployment: Cloud SaaS or on-premises, including air-gapped setups
What This Means in Practice
| Scenario | IronFlock | Secomea |
|---|---|---|
| Service engineer accesses a machine HMI | Click “Open Tunnel” in the browser | ✅ LinkManager Mobile / Prime in the browser, per-agent access |
| Program a PLC remotely | TCP tunnel to TIA Portal, CODESYS, TwinCAT — or full VPN via the WireGuard app | ✅ LinkManager VPN (Windows) with vendor-specific agents |
| Access serial-only legacy equipment | ✅ Modbus RTU/ASCII over RS-485/RS-232 in the Industrial Collector; other serial protocols via a containerized bridge app | ✅ Native serial and USB agents |
| See fleet telemetry on a dashboard | ✅ Built-in dashboards on FleetDB data | ❌ Forward data to Azure/AWS/Cumulocity and build dashboards there |
| Store machine data historically | ✅ Per-project TimescaleDB, auto-provisioned | ❌ Store-and-forward buffer only — storage is your cloud’s job |
| Run custom analytics at the edge | ✅ Deploy a Docker app to any device — Linux or Windows | ❌ SiteManager is a closed appliance |
| Alarm on a telemetry threshold | ✅ Alarm rules on any data stream with severity levels | ⚠️ DCM trigger conditions; device-down email/SMS alerts |
| Update 100 devices | One-click bulk OTA across the fleet (OS, agent, and apps) | Gateway firmware updates via GateManager |
| Audit who accessed what | ✅ Full audit trail | ✅ Audit logs, session recording, live session monitoring |
| Self-host the platform | ✅ Full platform on-premises | ✅ GateManager Own (access server only — no data platform) |
Feature Comparison
Data & Connectivity
| Feature | IronFlock | Secomea |
|---|---|---|
| PLC data collection | ✅ Industrial Collector — Modbus TCP/RTU, OPC UA, Siemens S7 and Allen-Bradley in one app, with a catalog of pre-mapped equipment profiles (S7 and Allen-Bradley in early access); plus IO-Link, BACnet and MTConnect collectors | ✅ DCM: OPC UA, Modbus TCP, S7, EtherNet/IP, MQTT |
| Automated time-series storage | ✅ Per-project TimescaleDB (auto-provisioned), direct SQL access | ❌ None — data is forwarded to Azure IoT Hub, AWS IoT Core, Cumulocity, Aveva, or MQTT |
| Dashboards on collected data | ✅ Built-in | ❌ In your third-party cloud |
| Serial / USB legacy equipment | ⚠️ Modbus RTU/ASCII over RS-485/RS-232 in the Industrial Collector; other serial and USB via containerized bridge apps | ✅ Native serial and USB-adapter agents |
| Vendor-specific device profiles | ✅ Industrial Collector profile packs — pick the equipment from a catalog and its tags, units and semantics are pre-mapped (expanding set) | ✅ 50+ pre-configured vendor agent types |
| Offline buffering | ✅ Devices operate fully autonomously, sync on reconnect | ✅ Store-and-forward with SD-card extension |
| Data isolation between projects | ✅ Physical database separation + cryptographic isolation | ✅ Domain separation on GateManager |
| LoRaWAN sensor integration | ✅ ChirpStack on virtual device | ❌ Not offered |
Visualization & Dashboards
| Feature | IronFlock | Secomea |
|---|---|---|
| Dashboard builder | ✅ No-code widget system in the browser | ❌ Not offered — data forwarded to third-party clouds |
| Widget library | ✅ Charts, gauges, maps, tables, forms, actions | ❌ |
| Industrial HMI graphics (P&ID) | ✅ Full SCADA symbol library | ❌ |
| Real-time updates | ✅ Sub-second via WAMP | ❌ (session monitoring dashboards only) |
| Embeddable dashboards | ✅ | ❌ |
| Custom branding | ✅ Per-customer isolated dashboards | ⚠️ Custom branding in Premium tier |
Remote Access & Security
| Feature | IronFlock | Secomea |
|---|---|---|
| Browser-based access (no client install) | ✅ HTTP(S), VNC, SSH tunnels from the browser | ✅ LinkManager Mobile / Prime: RDP, VNC, SSH, Telnet, web |
| Full VPN client | ✅ WireGuard app — install on any project, VPN to selected gateways; standard WireGuard clients on any OS | ✅ LinkManager (Windows only) |
| Per-device access granularity | ✅ Per-port tunnel permissions | ✅ Per-agent access — a core strength |
| Access request/approval workflow | ⚠️ Role-based permissions | ✅ Request + one-click approve/deny |
| Session recording & joint sessions | ❌ | ✅ Professional/Premium tiers |
| Secure file transfer with malware scan | ⚠️ Via tunnels | ✅ Professional/Premium tiers |
| Authentication | ✅ OIDC with TOTP 2FA | ✅ MFA (SMS), SSO via Entra ID/Okta (Professional+) |
| Zero open ports on devices | ✅ Agent calls out | ✅ SiteManager connects outbound |
| Audit logging | ✅ Full device and user audit trail | ✅ Audit logs + session monitoring; SIEM export (Splunk, Syslog) |
| Security certifications | ⚠️ Architecture designed for IEC 62443 / ISO 27001 / SOC 2 compliance | ✅ IEC 62443-4-1 certified; 62443-3-3/-4-2 compliant (audited); ISAE 3402 Type 2; Danish CNA |
| Self-hosted option | ✅ Full platform on-premises | ✅ GateManager Own (access server) |
App Development
| Feature | IronFlock | Secomea |
|---|---|---|
| Custom edge apps | ✅ Docker containers in any language, on any device | ❌ SiteManager is a closed appliance |
| Built-in cloud IDE | ✅ | ❌ |
| Git integration + CI/CD | ✅ GitHub, GitLab, built-in build and release | ❌ |
| App marketplace | ✅ Open — publish freely, with monetization | ❌ |
| REST API | ✅ Full REST API + Python/JS SDKs | ⚠️ SiteManager Embedded JSON API; platform API in Premium tier only |
AI & Analytics
| Feature | IronFlock | Secomea |
|---|---|---|
| Multi-agent AI orchestration | ✅ Built-in | ❌ Not available |
| Natural language queries over device data | ✅ | ❌ |
| Physical AI (execute functions on devices) | ✅ | ❌ |
| Edge ML inference | ✅ Via containerized apps (PyTorch, TensorFlow, ONNX) | ❌ No app runtime on gateway |
| Cloud analytics | ✅ Built-in via FleetDB + AI Service | ❌ In your third-party cloud |
Device & Fleet Management
| Feature | IronFlock | Secomea |
|---|---|---|
| Bulk OTA updates (OS, agent, apps) | ✅ | ⚠️ Gateway firmware via GateManager |
| Full OS control on the edge | ✅ Any Linux distribution (root access) or Windows | ❌ Closed appliance firmware |
| Device grouping and management | ✅ Device groups, settings, resilience | ✅ Domains and equipment grouping |
| Live logs from all apps | ✅ Streaming in browser | ⚠️ Gateway diagnostics |
| Virtual devices (cloud compute) | ✅ Run Grafana, Node-RED, Jupyter alongside physical fleet | ❌ |
| Device capacity per gateway | Not applicable — the agent runs on the machine itself | 10 agents (15xx) or 100 agents (35xx) per SiteManager |
| Unlimited users | ✅ | ❌ Concurrent-user limits per tier (e.g. 5/10/30 for machine builders) |
Alarms & Notifications
| Feature | IronFlock | Secomea |
|---|---|---|
| Configurable alarm rules on telemetry | ✅ On any data stream | ⚠️ DCM trigger conditions |
| Device-offline alerts | ✅ | ✅ Email/SMS heartbeat alerts |
| Email notifications | ✅ | ✅ |
| SMS notifications | ✅ | ✅ |
| Severity levels | ✅ Critical, Major, Minor | ❌ |
| Auto-resolve | ✅ | ❌ |
| Alarm history and analytics | ✅ | ❌ |
Pricing Comparison
Secomea: Quote-Based Subscription Tiers
Secomea does not publish prices. The subscription comes in three tiers — Essential, Professional, Premium — differentiated by support level (8/5 to 24/7), hosting (shared vs. private server, 1–3 regions), and features: SSO, session recording, secure file transfer, and joint sessions start at Professional; API access and custom branding are Premium-only.
Pricing is metered on active SiteManagers, active endpoints, and concurrent users (e.g. 5/10/30 concurrent users across tiers for machine builders) — exceeding the subscription allowance can raise the next year’s price. SiteManager hardware is purchased in addition. No free tier is advertised.
IronFlock: Free Cloud + Subscription for On-Premises
IronFlock’s cloud version is free — all core features (device management, dashboards, data storage, OTA updates, alarms, remote access, app deployment) are included at no cost, with unlimited users. IronFlock charges based on resource usage: storage, remote access sessions, virtual devices, and AI usage. There is no minimum contract and no concurrent-user licensing. See the pricing page for details.
Hardware is not constrained — any Linux or Windows device works, and machines that already contain an industrial PC need no additional gateway.
Additional capabilities can be added by purchasing apps from the marketplace — built by IronFlock or third-party developers.
For on-premises deployments (air-gapped or private infrastructure), IronFlock offers a subscription-based license.
When to Choose Secomea
Secomea may be the better choice if:
- Access governance is your primary requirement — per-agent permissions, request/approve workflows, session recording, joint sessions, and SIEM export form one of the most mature access-management stacks in industrial remote access.
- Your security team requires formal third-party attestations today — IEC 62443-4-1 certification, audited 62443-3-3/-4-2 compliance, and an ISAE 3402 Type 2 report.
- You service legacy equipment over serial or USB — native serial/USB agents cover equipment that Ethernet-only solutions cannot reach.
- You rely on vendor-specific access profiles — 50+ pre-configured agent types for Siemens, Rockwell, Mitsubishi, Omron, Beckhoff, and others reduce setup errors.
- You already run a data platform (Azure IoT Hub, AWS IoT Core, Cumulocity, Aveva) and only need collection and forwarding, not another storage layer.
- You want the access server on your own infrastructure without adopting a broader platform — GateManager Own covers exactly that.
When to Choose IronFlock as a Secomea Alternative
IronFlock is the stronger choice when:
- You need more than access — dashboards, historical data, alarms, and analytics without assembling and paying for a separate cloud platform to receive forwarded data.
- You want your data in an open database — per-project TimescaleDB with direct SQL access, auto-provisioned per project.
- You need edge computing — run Docker apps in any language on the machines themselves, from protocol converters to ML inference.
- You need built-in AI — natural language queries, multi-agent orchestration, physical AI execution on devices.
- You need real alarm management — severity levels, auto-resolve, and alarm history on any telemetry stream, not only device-down notifications and trigger conditions.
- You want full-platform self-hosting — the entire stack (access, data, dashboards, AI) on-premises, not just the access server.
- Transparent pricing matters — a free cloud tier with unlimited users and pay-per-use resources, instead of quote-only tiers metered on concurrent users and active gateways.
- You want OTA updates for everything — OS, agent, and apps across the fleet, with full OS control on your own hardware.
- You want VPN as an open capability — the WireGuard app installs on any project for full VPN to selected gateways, works with standard WireGuard clients on any OS (no Windows-only client), and the open marketplace lets third parties offer additional VPN solutions.
- You are an OEM building digital services beyond servicing — package monitoring, analytics, and AI as sellable apps for your customers.
Migration Path
IronFlock can run alongside Secomea. A common pattern: keep Secomea for the established service-engineer access workflows while deploying IronFlock’s agent on machines (or their industrial PCs) to add fleet dashboards, historical data, and alarms — capabilities Secomea forwards to third-party clouds. Since Secomea’s DCM speaks MQTT, existing data collection can even feed an IronFlock pipeline during the transition. As teams grow confident with IronFlock’s tunneling and host access, remote service consolidates onto the same platform that already holds the data, and new machines ship without a separate gateway appliance.
Ready to try it? Start free — connect a device and see your first dashboard in minutes.