An on-premise IoT platform runs in infrastructure an organisation owns or controls instead of relying entirely on a public-cloud environment. This shifts day-to-day operating responsibility to the buyer, while the vendor still controls the licence, roadmap and support channel. ISO/IEC 22123-1:2023 does not define “on-premise” as a cloud deployment model, so the term needs to be assessed in practical architectural terms.
The six platforms below can run in owned infrastructure, but they do so in very different ways. They are presented by architectural model—not market share—and this is not a ranking.
Two entries need qualification. Microsoft documents Azure IoT Operations as hybrid rather than on-premise. ThingWorx supports on-premise deployment in its current documentation, but its new owner did not name a deployment model in marketing materials reviewed on 14 September 2026.
Where the Cut Falls
Choosing on-premise is really a decision about where to cut the stack. The cut reallocates responsibility; it does not remove risk. It determines what continues to work when the uplink is severed and what operating burden the buyer takes on. Simply owning the server does not answer either question.
Vendor pages rarely make the immovable elements clear: licensing, product roadmap and the support channel. That matters, especially when ownership changes. PTC sold Kepware and ThingWorx to TPG in March 2026, while Cumulocity left Software AG through a January 2025 management buyout.
What Is an On-Premise IoT Platform?
An on-premise IoT platform runs its platform tier in infrastructure that the organisation owns or controls rather than in a provider’s environment. NIST SP 800-82r3 (2023) notes that IIoT functions may run in an on-site data centre, an off-site data centre or the cloud, depending on the implementation.
Location, control and continuity are separate variables. Buyers should define not only where hardware, software and data reside, but also where the control plane resides. Edge is a separate axis, not an alternative to on-premise: NIST positions it both vertically across the stack and horizontally across IIoT subsystems.
Why Industrial Sectors Look Inward
Industrial buyers usually choose local deployment for a specific physical constraint or named obligation. None of the instruments reviewed here creates a blanket requirement to deploy on-premise.
In manufacturing, the constraint is physics. 3GPP TS 22.104 (2023) sets motion-control communication requirements at transfer intervals of 500 µs to 2 ms. The PLC therefore hosts the control loop, while the platform tier can remain local, remote or hybrid.
Energy is the clearest example of a sector where current requirements can constrain outsourcing. Even so, NERC CIP-005-7 defines a logical security boundary rather than a building. A December 2025 NERC drafting-team paper says the Cyber Asset concept has “proved unworkable in a cloud environment”; that paper is not approved or endorsed by NERC. Meanwhile, NERC’s January 2026 CIP Roadmap recommends moving Project 2023-09 from medium to high priority.
Water utilities must assess and certify under America’s Water Infrastructure Act of 2018; they are not required to relocate systems. In telecommunications, the routers compromised in advisory AA25-239A (2025) were operator-owned. NIS2 makes the broader point: obligations apply whether an organisation manages its systems internally or outsources their maintenance.
Why Choose On-Premise IoT Instead of Cloud IoT?
Four reasons are supported by the instruments and incident records cited below. “It is more secure” is not one of them.
First is control over data and jurisdiction. The CLOUD Act reaches data in a provider’s possession, custody or control regardless of where the data is stored. EU Data Act Article 32(1) requires providers to prevent conflicting third-country governmental access to non-personal data held in the Union. Keeping data in-house is therefore a risk and governance choice, not a universal legal requirement.
Second is regulatory fit, where a rule can constrain outsourcing for a particular system class, such as NERC CIP. Third is deterministic control, which is limited by the PLC-based control loop. Fourth is the ability to operate at sites with unreliable or absent connectivity. NIST SP 800-82r3 notes that industrial outages often must be planned days or weeks in advance.
Europe also protects the reverse choice: Data Act Article 23 covers switching to on-premises ICT infrastructure, while Article 29(1) prohibits switching charges from 12 January 2027.
Security is where the argument ends, not where it begins. On-premise shifts security responsibility to the operator, and the result depends on segmentation, patch windows, MFA, privileged-access controls and monitoring. Dragos found poor IT/OT segmentation in 81% of its assessments and compromised VPN or jumphost credentials in 73% of all-time incident-response cases in its 2026 self-selected client sample. The 2026 Verizon DBIR reports that only 26% of CISA known-exploited-vulnerability entries were fully remediated across industries in 2025, with a 43-day median.
Cloud deployments can fail in the same way. A 2026 federal plea agreement describes a scheme affecting at least 165 organisations through stolen credentials used to access a SaaS provider. Mandiant and the provider’s CISO notice reported a campaign aimed at accounts using single-factor authentication. The decisive factor was the control, not the venue.
Ignition: The Owned Gateway
Ignition places the cut at the bottom of the stack. The buyer installs and operates the full stack on a Gateway; the remaining tether is economic.
Execution remains within the Gateway, while Ignition Edge retains up to 35 days or 10 million data points of local history. Drivers for Allen-Bradley, Modbus, Siemens, DNP3, BACnet and IEC 61850 are included, with MQTT available through Cirrus Link. Licences are perpetual and sold per server with unlimited devices and tags, although the vendor notes that hardware limits can create performance issues.
Watch-out: redundancy supports only two nodes. High availability covers the front end behind a load balancer, and each redundant node needs another licence. Ignition 8.1 loses active support on 16 September 2027.
ThingsBoard: Two Cuts
ThingsBoard offers two distinct deployment models. Community Edition is Apache 2.0 and has no runtime tether; its pricing FAQ states that it can run completely offline.
Its fifteen open-source gateway connectors cover MQTT, Modbus, OPC UA, BACnet and KNX. The trade-off is operational effort. A single-server installation has no high availability, while the documented HA design adds Kafka, Zookeeper, Redis, replicated PostgreSQL and Cassandra. Open source removes the licence fee, not the maintenance calendar: LTS lines last eighteen months, and version 4.1.x and earlier are already end of life.
Features that often matter in governance reviews—finer role separation, Scheduler, scheduled Reporting and Secrets Storage—are Professional Edition features. Community Edition has only three fixed roles, and its only non-administrator role is read-only. An operator, technician and auditor cannot therefore have distinct write permissions.
Professional Edition has the tightest runtime tether of the six. If licence-server requests fail for a configurable period, typically 24 hours, the client can shut down the instance; the same documentation says it may shut down after more than 24 hours offline.
Watch-out: offline operation is a priced add-on with no published price, and every replica requires its own licence.
ThingWorx Under New Ownership
TPG launched Velotic in March 2026, naming Proficy, Kepware and ThingWorx as distinct product lines. The model is an on-premise runtime with a dated licence, so the main tether is an expiry date rather than a call-home requirement.
On-premise deployment remains current in the documentation. The 10.2 guide describes running ThingWorx on servers in the customer’s site or data centre, and its upgrade instructions apply to on-premise installations. Brownfield connectivity is its major strength: the Kepware store returns 184 results across a filter that includes OPC UA, Modbus, EtherNet/IP and DNP3. Disconnected mode is documented for instances without internet access. However, an unrenewed licence causes ThingWorx to shut down after a 20-day warning.
Watch-out: PTC’s newest ThingWorx advisory was dated 15 August 2024, although PTC continued publishing 2026 advisories for retained products. As of 14 September 2026, Velotic published no advisory page and named no deployment model.
Cumulocity IoT Edge: The Purchasable Cut
Cumulocity sells the cut as a product choice. Connected Edge retains a cloud management plane, while Air-Gapped Edge removes it. The boundary is therefore purchasable rather than purely architectural.
The vendor states that Edge can run anywhere from a standard local network to fully offline, air-gapped environments, with local data collection and analysis continuing without a cloud connection. Across roughly fifty published capability rows, the two plans differ on four; air-gapping mainly trades remote manageability and hosted identity for independence.
Watch-out: Edge has no cluster, horizontal scalability or zero-downtime upgrade. Its documented interfaces are REST, MQTT and OPC UA, and Edge is excluded from both published service levels.
Azure IoT Operations: Rented Control
Azure IoT Operations is a hybrid platform with local compute, not an on-premise platform. Microsoft does not label it on-premise. That makes it a useful example of where the cut lies rather than an exception to the comparison.
Microsoft’s documentation defines the boundary in parts. The product can operate offline for up to 72 hours, with possible degradation; full functionality resumes after reconnection. Azure Arc does not support clusters that cannot access Azure, and Microsoft states that the cloud is the source of truth for device and asset configuration. Even the most restricted deployment path pulls a billing container from Microsoft’s registry. The data-residency guarantee applies to data, not the control plane, though runtime and compute remain on the customer’s premises.
Watch-out: Azure IoT Operations has no on-premise dashboard. Microsoft directs visualisation to cloud services such as Fabric and Power BI. It documents HTTP/REST, SSE, OPC UA and MQTT toward devices, but not Modbus or PROFINET, and supports only the latest release plus two minor versions.
Iotellect: Two Licence Paths
Iotellect uses the same server software at the edge, on an owned server and in a cloud account. The buyer chooses where to deploy it.
Its key distinction is runtime parity: the server runs on single-board PCs, IoT gateways, industrial PCs, touch panels and PLCs, down to a 1 GHz CPU and 512 MB RAM. Its edge, on-premise and hybrid architecture provides one distributed model in which each node can continue operating when connectivity drops. Iotellect connectivity is documented by protocol rather than a single count: four Modbus variants, the full OPC UA stack, OPC DA/AE/HDA, DNP3, IEC 60870-5-104 in master and slave modes, BACnet IP and MS/TP, plus Siemens S7 and Omron FINS.
Pricing is resource-based instead of device-metered. Published plans size an instance by CPU, memory and disk rather than devices, events or API calls, and offer perpetual licences alongside subscriptions. On-premise starts from the Standard plan. The usual approach is a local Named Licence locked to the server or virtual machine. Containers use a licence server instead: each Iotellect Server periodically checks validity using a documented Check Period and Grace Period, but Iotellect does not publish default durations. No page describes validated air-gapped operation, so the licence path should be settled in procurement.
Watch-out: failover does not preserve the operator session. After the master node fails, operators must reach the failover node manually or through DNS.
Dashboards, Analytics, Automation, APIs, Customization and Integration
Across these six areas, the platforms differ less by whether a capability exists than by who builds and operates it, whether it runs on the buyer’s hardware or in a vendor cloud, and what each customisation costs at upgrade time.
Dashboards show a meaningful split. Ignition, ThingsBoard, ThingWorx, Cumulocity Edge and Iotellect render operator screens on owned hardware. ThingsBoard’s SCADA dashboard layout, which pins symbols to a fixed grid for process diagrams, is included in Community Edition. Azure IoT Operations has no local dashboard and routes visualisation to cloud services such as Fabric and Power BI; even Microsoft’s shop-floor example renders from the cloud. Build effort still varies among the five local options: Ignition prices Perspective and Vision separately, while Iotellect’s off-the-shelf interface is intended for administrators, DevOps engineers and low-code developers.
Analytics also crosses a paid boundary. ThingsBoard supports calculated fields in Community Edition, but prediction and anomaly detection sit in its Trendz add-on, marked Professional Edition and Cloud, with separate installation, hosting and licensing. ThingWorx Analytics installs separately on customer Linux or Windows servers. Iotellect documents supervised and unsupervised learning algorithms plus a StreamSQL event correlator that can run at the edge, on-premise or in the cloud. Cumulocity runs Streaming Analytics at Edge but publishes no capability limits for that runtime variant.
Automation and API capability depend on the vendors’ own caveats. Microsoft’s overview names neither an on-cluster alarm engine nor closed-loop control for Azure IoT Operations. Ignition’s 8.3 Gateway REST API warns that keys grant full access to its HTTP API routes, GET requests are not recorded in audit logs, and rate limiting is not broadly implemented. Iotellect’s REST API supports retrieve and update operations, not create or delete.
Customization and integration constraints are similarly important. Cumulocity extensions must be stateless and cannot use persistent volumes. Ignition gives databases outside six tested connections “Limited Support.” ThingWorx 10.0 moved to Jakarta EE 11, so extensions that still call javax APIs no longer work correctly.
What Features Should an On-Premise IIoT Platform Have?
Evaluate an on-premise IIoT platform using named evidence: accredited conformance testing, device identity that survives provisioning, store-and-forward for the stated disconnection window, and support terms that match the asset’s life.
Ask vendors in writing which functions continue to operate when the uplink is severed, and for how long. Rehearse that window through a controlled reconnection. Confirm whether any part of the control plane is outside the buyer’s perimeter. Then ask four licence questions: Is validation local or remote? What happens, and after what timeout, if the licence server is unavailable? What are the term and expiry conditions? Is offline operation configuration, or a priced option?
For IEC 62443, the category-level answer is clear: none of these six has a product certification, and none has ISO 27001 or SOC 2 coverage for self-hosted software. Inductive Automation has an IEC 62443-4-1-certified development process, while Cumulocity’s ISO scope names only its two SaaS editions. This twenty-point IoT platform selection checklist covers criteria that are not specific to hosting. ANSI/ISA-62443-2-1-2024 assigns responsibility to the asset owner regardless of platform choice.
The Last Tether Is the Licence
In a self-hosted estate, the final tether to the vendor is often the licence, not telemetry. A licence failure can stop the platform rather than degrade it. Four of the six document a licence path that calls home or expires. ThingsBoard CE and Cumulocity’s air-gapped plan, which have no runtime tether, make that contrast clear.
The warning sign is product withdrawal. Vendors are more likely to withdraw or neglect the on-premise edition than the cloud service. When an edition disappears or loses its advisory channel after an ownership change, an operator may face a migration that its maintenance calendar cannot absorb.
The probability is not measured, but two indicators matter. A NERC drafting team says that many vendors are deprecating or eliminating on-premise product versions and cautiously suggests that this may be accelerating. The second indicator is a divested product line whose newest advisory predates the sale. All six platforms still documented on-premise as a maintained option on pages fetched in September 2026.
The contract should therefore include an end-of-availability notice period for the on-premise edition, a named advisory channel with disclosure commitments, support terms matched to asset life, and an annual restore-and-run rehearsal on clean hardware.
Which Deployment Model Is Best for Industrial IoT?
There is no single best industrial IoT deployment model because the answer differs by tier. As a rule of thumb, physics fixes the control tier locally; the longest outage the process must absorb determines the site tier; and the regulatory perimeter plus available operating staff determine the fleet tier. NIST SP 800-82r3 notes that OT components often remain in service for 10 to 15 years or more. Where these requirements conflict, a hybrid design is the logical result.
What This Comparison Cannot Tell You
Five reasonable questions cannot be answered from the public record.
What does each platform cost to own over five years, including staffing? No transparent public TCO study covers this category, and academic work concludes that a generic formal model cannot exist. This comparison addresses licensing structures only.
How many industrial operators use each platform on-premise? No dataset measures IoT-platform deployment share. Eurostat measures something narrower: 11.3% of EU27 manufacturers with at least ten employees rented cloud computing power to run their own software in 2025; the remainder is not an on-premise share.
How frequently does a link fail at a particular site? The sections above identify what stops when it does, not how often it will happen.
How quickly does a critical vulnerability reach a self-hosted installation, and who notifies the operator? None of the vendors publishes a patch-response target for self-managed installations.
How do the six perform relative to one another? No independent benchmark exists, so every capability and performance statement above is a vendor claim with its own caveat.
Where to Start
For a plant whose main requirement is supervisory control, start with an on-premise SCADA, HMI and historian stack. That is how Iotellect, the publisher of this article, packages the job.
Bottom line: sever the uplink, record what stops, then test what the licence does on the second day.
Ownership tells you where the server sits. The cut tells you what happens when the link drops.