QUESTIONS & ANSWERS
The questions we actually get asked.
Straight answers about what UR Maintain does, what it needs from your environment and where it stops. Where the honest answer is "no", that is what it says.
EVALUATING IT
What it is, and who it is for.
Short answers first; the product status page has the detail.
What is UR Maintain?
A CMMS for industrial maintenance teams — a maintenance department's operating system rather than a reporting dashboard. It covers breakdowns, work orders, machines, preventive maintenance, spare parts and inventory, technical documents and search in one system.
Who is it built for?
Seven roles ship as configuration: Technician, Supervisor, Planner/Scheduler, Storekeeper, Maintenance Manager, Director and Organization Admin. The product is designed technician-first — the person standing at the machine is the primary user, and management data is a by-product of good operational workflows rather than a reason to burden them.
Is it a finished product?
Yes. UR Maintain is live and on sale, with a real database, real permissions and real offline behaviour, as a managed cloud service or self-hosted. The product status page lists precisely what it does today.
Can we evaluate it before committing?
Yes. The browser demo with sample data is free and carries no commitment. It starts a conversation about your maintenance workflow and which deployment model fits your IT requirements.
DEPLOYMENT & IT
What it needs from your environment.
Two editions over one codebase and one data model; the deployment model is a choice, not a fork in the product.
Cloud or self-hosted?
Both are supported editions built from the same application code and data model: a managed cloud service, or self-hosted on infrastructure your organisation controls. Data portability is a design requirement, not a favour.
What does self-hosting require?
The specified baseline is a modern x86_64 Linux host (Debian/Ubuntu class) with the Docker Engine and Compose plugin, persistent NVMe or SSD storage, DNS and TLS, and optional SMTP. The initial recommended size for a small production host is roughly 8 vCPU, 16 GB RAM and NVMe, subject to measured load. The installation bundle exists — a versioned Compose file, an environment template with validation, the migrations, a preflight check, health checks, an upgrade and rollback path, a backup and restore pair, a support-bundle generator and a version report — and its install, upgrade, rollback and destroy-and-restore paths have been rehearsed end to end, with the transcript committed. What is not finished is the layer around it: no metrics or alerting backend is deployed, and a licence is not activated or verified by the software. See the status page.
Can it use our identity provider?
Authentication runs through Keycloak, which supports OIDC/OAuth2 and, as capability, SAML, LDAP, Active Directory and multi-factor authentication. Sign-in today uses the authorization-code flow with PKCE and no password touches the application. Customer SSO configuration and enforced MFA are not configured or tested yet — that work is scoped for the enterprise edition.
Does it integrate with our ERP, SCADA or PLC?
No, and this is deliberate. UR Maintain is not an ERP, not a SCADA/HMI front end, not a PLC engineering suite, not an MES and not an IoT platform. It sends no start, stop or reset commands to machines and implements no safety interlocks. It is built to deliver its core value without ERP, SCADA, PLC or IoT integration.
Is there an API we can build on?
The application is built on a documented HTTP API and the front end is one of its clients, so the foundation exists. Outgoing webhooks are live. A supported public API for building your own integrations is a later release, not a current offering.
OFFLINE & FIELD WORK
How it behaves when the network is not there.
This is the part buyers test hardest, so the limits are stated precisely.
Does it work with no network?
Yes for the field work that matters most. Filing a defect report is stored on the device first; the job commands take, start, wait, resume, machine running and finish the report all work offline; and a photo taken on the job screen is kept on the device and uploaded once the plant is reachable.
Can it start up with no network at all?
The application ships with a service worker that precaches its own shell, so a handheld closed in a dead zone opens the application again instead of a blank page, and an /api/ path is never answered out of that cache. Stated limit: no automated test exercises the worker — the browser suite runs the development server, where the plugin registers nothing — so it is described as configured rather than claimed as proven. What is tested today is a full reload with the API unreachable, which proves the application's own offline gate rather than the worker.
What is not offline?
Supervisor actions — verify, close, cancel, assign — are online-only by design. Everything a technician does in the field, including inspections, inventory movements, preventive-maintenance commands and shift handovers, works offline and is queued until the plant is reachable.
What happens when an offline report is refused?
A refusal is durable and visible: the report is marked “Needs review” on the device with the reason, and a retry returns the same answer instead of looping silently. Nothing disappears.
Does search work offline?
Yes. With no connection the search box answers about the plant's machines, jobs and parts held on the device, and labels the results as offline.
DATA & MIGRATION
Getting your plant's information in.
The import path has a page of its own — these are the short answers.
How do we get existing data in?
By CSV, staged rather than loaded blind. The plant judges every row before writing anything and reports each one back as valid, warning, error or applied, with a message a human can act on. You see the whole file's outcome before a single machine is created.
Will importing a file twice create duplicates?
No. A row already applied is skipped, and a re-import updates rather than duplicates — either through the external identifiers your legacy file carries, or through a natural key the plant proposes (asset tag for a machine, part number for a part) and refuses to apply until a human confirms.
What can an import not change?
An asset's tag, a part's number, an asset's site, lifecycle fields, stock policy and money. What a legacy export actually carries — names, makers, models, serial numbers, descriptions, units — is what moves.
Can we export our data?
Yes. A plant can export its data, and a deletion workflow covers the end of a contract.
Do you have a fixed onboarding timeline?
No, and any vendor quoting one before seeing your data is guessing. The sequence is defined — organisation and sites, identity and roles, staged imports, priority documents and current PM, QR labels, stock locations and controlled opening balances, then training and a shadow week before cutover. How long that takes depends on the quality of your existing data.
SECURITY & DATA
Isolation, permissions and what we do not claim.
The security page covers the mechanisms and the gaps in full.
How is our data separated from other plants?
In the database, not by convention. Every plant's rows are isolated with PostgreSQL row-level security in forced mode, so the policy applies to the table owner too, under a runtime role that cannot bypass it. Another plant's record answers as “not found” rather than leaking, and a reference to another plant's site or machine is refused by the database.
Who can see and do what?
Access is checked as a permission, a plant membership and a site scope — never a role name hard-coded in a screen. Seven roles ship as seed configuration with a published permission matrix. A screen is told what the caller may do rather than probing for it, and a control the caller lacks is drawn disabled with the plant's own reason.
Is there an audit trail?
Yes. An audit log records who did what, with actor, timestamp and reason. For stock, the immutable ledger row is further evidence.
Do you claim NIS2 or CRA compliance?
No, and the documentation forbids it. The Cyber Resilience Act material is an engineering readiness plan, not a conformity classification, and no CE or CRA conformity is claimed. The NIS2 material says neither customers nor the vendor may be advertised as automatically NIS2 compliant. OWASP ASVS 5.0.0 is our verification baseline — deviations are recorded rather than summarised as compliance.
SCOPE & FIT
What it deliberately is not.
Saying no is part of the design. A tool that claims all of this ends up doing none of it well.
Is it an ERP, IoT platform or predictive-maintenance product?
No. UR Maintain is none of those, by an explicit product decision. It is not an ERP, SCADA/HMI, PLC engineering suite, MES, IoT platform, payroll or HR suite, procurement ERP, or a safety or control system — and it does not compute automatic OEE or promise predictive maintenance.
Does it need sensors or machine integration to work?
No. It delivers its core value without PLC, SCADA or IoT integration. Technicians report what happened at the machine; the system makes that report cheap to file and impossible to lose.
Is there a native mobile app?
No. The field client is a web application installed from the browser, which is what lets it run on whatever devices your team already carries. Native iOS and Android apps are out of scope.
What would you point out as the biggest gap?
The one we would raise ourselves: no third-party security assessment or certification has been completed yet, and customer SSO and enforced MFA are not configured out of the box. The security page lists every stated limit.
STILL UNANSWERED?
Ask the question we have not covered.
If your evaluation needs a specific answer, ask directly — we will tell you whether it is built, planned or missing.