OTDeck for teams

The Team plan is $149 per seat per year. It includes everything in Pro and adds what an integrator or a plant automation team needs to work from the same device list without anyone weakening its safety settings. Team is in the beta now and goes on sale with the first paid release.

Shared projects

Keep brokers, Modbus devices with their register ranges (table, address, data type, byte and word order) and OPC UA endpoints with their watch lists in a JSON file on a shared drive, as a folder of files in a git checkout (every .json file in it is read), or at an https URL, and point OTDeck at it in Settings → Team. Everyone on the team sees the same connections with a Team badge; they are read-only in the editor. OTDeck re-reads the source every 15 minutes and keeps the last good copy, so it also works on site without internet. AI agents (otdeck-mcp) see the same connections, as far as the policy allows.

The file never contains passwords or key passphrases: OTDeck refuses a file that does. The first time someone connects to a team connection that has a user name, OTDeck asks for their own password, which stays in their system keychain; if the file later changes that connection's host or security settings, the stored password is withheld until it is typed again.

Team policy

The policy block of the file decides, on every member's computer:

• productionReadOnly: every production connection of the file is read-only, whatever its own readOnly says. OTDeck's backend refuses writes and MQTT publishes on it.
• Always, without a setting: a personal connection that points at the same device or broker as a team connection (same protocol, host and port, serial port, or OPC UA server) gets at least the team connection's role and read-only switch. A personal copy, or the address typed by hand, does not turn a protected PLC into a lab one.
• agents: all (default), non-production or none. What AI agents may read through otdeck-mcp; hidden connections are not listed to agents, are refused by name, and their trend and recorded series are left out.
• noPersonalCopies: no personal connections to the team's devices at all.

The policy guards against mistakes, not against the owner of the computer: someone who can edit OTDeck's files can remove the shared project. An administrator can pin the source so it cannot be changed in Settings (below).

{
  "version": 2,
  "team": { "name": "Acme Integrators", "contact": "[email protected]" },
  "policy": {
    "productionReadOnly": true,
    "agents": "non-production",
    "noPersonalCopies": false
  },
  "profiles": [
    {
      "id": "line1-press",
      "name": "Line 1 press PLC",
      "group": "Plant 1",
      "protocol": "modbus",
      "role": "production",
      "modbus": {
        "mode": "tcp",
        "host": "10.0.4.12",
        "port": 502,
        "unitId": 1,
        "timeoutMs": 1000,
        "pollMs": 1000,
        "ranges": [
          { "id": "pressure", "label": "Pressure bar", "table": "holding", "address": 10, "count": 1, "type": "float32", "wordOrder": "high" }
        ]
      }
    },
    {
      "id": "plant-broker",
      "name": "Plant MQTT broker",
      "protocol": "mqtt",
      "role": "staging",
      "mqtt": { "transport": "tls", "host": "broker.plant.example", "port": 8883, "username": "otdeck-ro" }
    }
  ]
}

Rules: version is 1 or 2 (team and policy need 2); every connection needs a unique id (letters, digits, ., _, -), a name and a protocol; unknown fields are refused; at most 500 connections and 1 MB per file, 64 files in a folder. In a folder, ids must be unique across files and the strictest policy wins.

Making the team file

Set the connections up in OTDeck, then Settings → Team → Export for team…: choose connections, the team's name and who maintains the file, and the policy. OTDeck writes a version 2 file without any secret. To extend a shared project, export again with "the connections of the shared project in use" ticked: their ids stay the same, so nobody has to enter their passwords again.

Seats

One Team subscription has as many seats as you buy. Whoever pays is the billing manager: in the Polar customer portal they assign each seat to a teammate's email. Each teammate gets their own OTDECK- key for up to 3 of their computers. A seat can be taken back and given to someone else; the old key stops working at its next weekly check (or within 30 days on a computer that stays offline). OTDeck never sends names or emails of your team anywhere.

Managed deployment

To roll OTDeck out on engineering laptops or edge PCs, provide on the machine:

• the key: the environment variable OTDECK_LICENSE_KEY, or a file with the key on its first line (%ProgramData%\OTDeck\license.key on Windows, /etc/otdeck/license.key on Linux, /Library/Application Support/OTDeck/license.key on macOS);
• the shared project: OTDECK_TEAM_SOURCE, or a team-source file next to license.key with the path, folder or https URL on its first line. Settings then shows it as set by the administrator and cannot change it.

Machines on an air-gapped network activate offline: OTDeck writes a request file, someone uploads it at otdeck.com/activate from any online computer, and the response file is imported back. No machine on the plant network needs internet access.

Write log

Every MQTT publish, Modbus write and OPC UA write OTDeck sends, and every one its guard refuses, is appended to a local log (one JSON line each: time, user, connection, role, target, value, result). Each line carries a hash of the line before it, so an edited or removed line is reported. Settings → Write log exports it for your records. The log is on every plan and never leaves the computer.

Support

Team customers get priority email support at [email protected]. For more than 200 seats or an invoice, write to the same address.