QUESTIONS & ANSWERS
The questions we actually get asked.
Straight answers about what UR Maintain does, what it needs from your environment and where it stops. Where the honest answer is "not built yet", that is what it says.
EVALUATING IT
What it is, and who it is for.
Short answers first; the product status page has the detail.
What is UR Maintain?
A CMMS for industrial maintenance teams — a maintenance department's operating system rather than a reporting dashboard. It covers breakdowns, work orders, machines, preventive maintenance, spare parts and inventory, technical documents and search in one system.
Who is it built for?
Seven roles ship as configuration: Technician, Supervisor, Planner/Scheduler, Storekeeper, Maintenance Manager, Director and Organization Admin. The product is designed technician-first — the person standing at the machine is the primary user, and management data is a by-product of good operational workflows rather than a reason to burden them.
Is it a finished product?
No, and we will not pretend otherwise. A working application exists with a real database, real permissions and real offline behaviour, and it is offered as early access while the remaining slices are built. The product status page lists precisely what works today and what does not.
Can we evaluate it before committing?
Yes. Requesting early access carries no payment and no commitment — it starts a conversation about your maintenance workflow and which deployment model fits your IT requirements.
DEPLOYMENT & IT
What it needs from your environment.
Two editions over one codebase and one data model; the deployment model is a choice, not a fork in the product.
Cloud or self-hosted?
Both are supported editions built from the same application code and data model: a managed cloud service, or self-hosted on infrastructure your organisation controls. Data portability is a design requirement, not a favour.
What does self-hosting require?
The specified baseline is a modern x86_64 Linux host (Debian/Ubuntu class) with the Docker Engine and Compose plugin, persistent NVMe or SSD storage, DNS and TLS, and optional SMTP. The initial recommended size for a small production host is roughly 8 vCPU, 16 GB RAM and NVMe, subject to measured load. The installation bundle exists — a versioned Compose file, an environment template with validation, the migrations, a preflight check, health checks, an upgrade and rollback path, a backup and restore pair, a support-bundle generator and a version report — and its install, upgrade, rollback and destroy-and-restore paths have been rehearsed end to end, with the transcript committed. What is not finished is the layer around it: no metrics or alerting backend is deployed, nothing reads SMTP yet, and a licence is not activated or verified by the software. See the status page.
Can it use our identity provider?
Authentication runs through Keycloak, which supports OIDC/OAuth2 and, as capability, SAML, LDAP, Active Directory and multi-factor authentication. Sign-in today uses the authorization-code flow with PKCE and no password touches the application. Customer SSO configuration and enforced MFA are not configured or tested yet — that work is scoped for the enterprise edition.
Does it integrate with our ERP, SCADA or PLC?
No, and this is deliberate. UR Maintain is not an ERP, not a SCADA/HMI front end, not a PLC engineering suite, not an MES and not an IoT platform. It sends no start, stop or reset commands to machines and implements no safety interlocks. It is built to deliver its core value without ERP, SCADA, PLC or IoT integration.
Is there an API we can build on?
The application is built on a documented HTTP API and the front end is one of its clients, so the foundation exists. A supported public API and outgoing webhooks are not released yet — that is a later release, not a current offering.
OFFLINE & FIELD WORK
How it behaves when the network is not there.
This is the part buyers test hardest, so the limits are stated precisely.
Does it work with no network?
Yes for the field work that matters most. Filing a defect report is stored on the device first; the job commands take, start, wait, resume, machine running and finish the report all work offline; and a photo taken on the job screen is kept on the device and uploaded once the plant is reachable.
Can it start up with no network at all?
The application ships with a service worker that precaches its own shell, so a handheld closed in a dead zone opens the application again instead of a blank page, and an /api/ path is never answered out of that cache. Stated limit: no automated test exercises the worker — the browser suite runs the development server, where the plugin registers nothing — so it is described as configured rather than claimed as proven. What is tested today is a full reload with the API unreachable, which proves the application's own offline gate rather than the worker.
What is not offline?
Inspections, inventory movements, preventive-maintenance commands and shift handovers need a connection. Supervisor actions — verify, close, cancel, assign — are online-only by design. The screens say so rather than pretending to queue the work.
What happens when an offline report is refused?
A refusal is durable and visible: the report is marked “Needs review” on the device with the reason, and a retry returns the same answer instead of looping silently. Nothing disappears.
Does search work offline?
Partly, and it says so. With no connection the search box answers only from what the device itself holds — the reports filed on it and the commands issued from it. The plant's machines, jobs and parts are not cached on the device, and the screen states that rather than presenting the subset as the plant's answer.
DATA & MIGRATION
Getting your plant's information in.
The import path has a page of its own — these are the short answers.
How do we get existing data in?
By CSV, staged rather than loaded blind. The plant judges every row before writing anything and reports each one back as valid, warning, error or applied, with a message a human can act on. You see the whole file's outcome before a single machine is created.
Will importing a file twice create duplicates?
No. A row already applied is skipped, and a re-import updates rather than duplicates — either through the external identifiers your legacy file carries, or through a natural key the plant proposes (asset tag for a machine, part number for a part) and refuses to apply until a human confirms.
What can an import not change?
An asset's tag, a part's number, an asset's site, lifecycle fields, stock policy and money. What a legacy export actually carries — names, makers, models, serial numbers, descriptions, units — is what moves.
Can we export our data?
Not yet. Import works; export does not exist, and neither does a tenant export or deletion workflow. Both need a decision about what a plant is entitled to take out before they can be built. We would rather say that than show a button that does nothing.
Do you have a fixed onboarding timeline?
No, and any vendor quoting one before seeing your data is guessing. The sequence is defined — organisation and sites, identity and roles, staged imports, priority documents and current PM, QR labels, stock locations and controlled opening balances, then training and a shadow week before cutover. How long that takes depends on the quality of your existing data.
SECURITY & DATA
Isolation, permissions and what we do not claim.
The security page covers the mechanisms and the gaps in full.
How is our data separated from other plants?
In the database, not by convention. Every plant's rows are isolated with PostgreSQL row-level security in forced mode, so the policy applies to the table owner too, under a runtime role that cannot bypass it. Another plant's record answers as “not found” rather than leaking, and a reference to another plant's site or machine is refused by the database.
Who can see and do what?
Access is checked as a permission, a plant membership and a site scope — never a role name hard-coded in a screen. Seven roles ship as seed configuration with a published permission matrix. A screen is told what the caller may do rather than probing for it, and a control the caller lacks is drawn disabled with the plant's own reason.
Is there an audit trail?
No. There is no tamper-resistant audit-log table yet. Where a movement must be provable — stock, for instance — the immutable ledger row itself is the evidence, carrying actor, timestamp, reason and the signed change.
Do you claim NIS2 or CRA compliance?
No, and the documentation forbids it. The Cyber Resilience Act material is an engineering readiness plan, not a conformity classification, and no CE or CRA conformity is claimed. The NIS2 material says neither customers nor the vendor may be advertised as automatically NIS2 compliant. OWASP ASVS 5.0.0 is our verification baseline — deviations are recorded rather than summarised as compliance.
SCOPE & FIT
What it deliberately is not.
Saying no is part of the design. A tool that claims all of this ends up doing none of it well.
Is it an ERP, IoT platform or predictive-maintenance product?
No. UR Maintain is none of those, by an explicit product decision. It is not an ERP, SCADA/HMI, PLC engineering suite, MES, IoT platform, payroll or HR suite, procurement ERP, or a safety or control system — and it does not compute automatic OEE or promise predictive maintenance.
Does it need sensors or machine integration to work?
No. It delivers its core value without PLC, SCADA or IoT integration. Technicians report what happened at the machine; the system makes that report cheap to file and impossible to lose.
Is there a native mobile app?
No. The field client is a web application installed from the browser, which is what lets it run on whatever devices your team already carries. Native iOS and Android apps are out of scope.
What would you point out as the biggest gap?
The one we would raise ourselves: there is no audit log and no export yet, so a compliance-driven evaluation should treat those as open items rather than assume them. After that, offline coverage is partial by design — it protects the field work that cannot wait and refuses to pretend about the rest.
STILL UNANSWERED?
Ask the question we have not covered.
If your evaluation needs a specific answer, ask directly — we will tell you whether it is built, planned or missing.