For Your IT Team

A one-page brief for the IT and security teams asked to approve or host an EEI Seeq connector. Each point links to the page with the detail.

The short version

• Nothing new runs on the host. The connector is a bundle inside your existing Seeq agent, under the agent's account. It needs Java 21 on the agent host.
• Two suppliers, one host. Seeq provides and primarily supports the Seeq agent. EEI provides and supports the connector inside it, and helps with the agent as needed.
• Outbound only, to two places. Your source system, and your Seeq server through the agent. No listening ports, and no connection to EEI.
• A polite client. Bounded concurrency, back-off, and a circuit breaker protect your source system. Rejected sign-ins are not retried.
• Credentials sit in a secrets store on the agent host, not in the configuration Seeq administrators can view: one file, managed with the vf-agent command-line tool. Protect the agent's data folder accordingly. Need a different arrangement, such as your own vault? We work it out with you.
• Certificate validation is available on https connections, per connection. It is off by default, for compatibility.
• The license is a local file, checked on the host without contacting EEI.
• Rollback is reinstalling the previous bundle.

What is installed, and where

Installed into	The Seeq Link agent's connector folder, as one bundle
Runs as	The Seeq agent's service account, in the agent's process
Requires	Java 21 on the agent host, and network reach to the source system
Writes to	The agent's data folder only. What it writes

Who supports what. The Seeq agent is Seeq's product: its installation, upgrades, service account and connection to your Seeq server are supported by Seeq in the first instance. The connector is EEI's. Where a question sits between the two, for example an agent upgrade before a connector upgrade or a connector that will not load, EEI works it with you and with Seeq rather than passing it back. If you buy through Seeq, your Seeq support path is the usual first contact for either; see Getting Support from EEI.

Network

To	Protocol	Notes
Your source system	As its API requires. For ABB KM, the WebAPI over http or https with NTLM or Kerberos sign-in	The address is in the connector's configuration
Your Seeq server	Through the Seeq agent's existing connection	Nothing extra to open

No inbound ports. No calls to EEI. How the connector paces its requests, and what you can tune, is on How EEI Connectors Behave on Your Network.

Credentials

The account the connector uses to sign in to your source system is kept in the VForge secrets store: one file on the agent host, vforge/secrets/credentials.json in the agent's data folder, shared by every EEI connector on that agent. Each datasource's credential is found by the datasource's ID, so the connector configuration, which Seeq administrators can read from within Seeq, holds only the placeholder VFORGE_SECRETS. Configuration backups never contain a password.

• Managed with vf-agent, a command-line tool the connector installs in vforge/bin/. It sets, shares, lists and checks credentials, and moves existing passwords out of a configuration in one command. It never takes a password on the command line and never prints one.
• One service account for many datasources is stored once and shared.
• Fails safe. A datasource without a usable credential stays inactive and says so in the log; the others keep running.
• What it protects against, and what it does not. The store keeps credentials out of Seeq's view of the configuration. It is a plain file on the host, readable by the agent's account and local administrators, the same boundary as Seeq's own SECRETS_FILE: references, which the store also accepts.

Which connectors use it: ABB Knowledge Manager from its next release; the metadata connector to follow. Until a connector uses the store, its credentials are in its configuration file, as before.

Recommended: - Use a dedicated, read-only service account. - Restrict the agent data folder, and vforge/secrets/ in particular, to the agent's account and administrators. vf-agent secrets verify reports wider access.

Your own secrets arrangement. If your organization requires something else, for example credentials from your own vault (AWS Secrets Manager, Azure Key Vault and similar) or integrated Windows authentication, tell us: we work out a solution with you. Today, anything that can place a secret in a file on the agent host can feed the store through a SECRETS_FILE: reference. For ABB KM, the details are in the user guide's Credentials section.

Certificates

On https connections, certificate validation is a per-connection setting: accept any certificate (the default, for compatibility with self-signed servers), the host's trust store, or a certificate file you supply. Hostname checking comes with validation. See Certificate validation.

Licensing

A license is a small signed file, bound to the agent host by a one-way hashed fingerprint. It is verified on the host, with no network call. You send EEI the fingerprint file the connector writes, and place the license file EEI returns. See Licensing and Installing a License.

Change, upgrade and rollback

• EEI delivers each update and coordinates the timing with you. Nothing updates itself.
• An upgrade replaces the bundle. Item identities are preserved, so existing Seeq analyses keep working.
• Rollback is reinstalling the previous bundle.
• Each connector's release notes say what changed, and what the upgrade requires.

EEI as a supplier

How EEI secures its own systems, handles data, and where its compliance program stands is in Trust. How EEI builds and releases software is in Engineering Practice. For anything this page does not answer, ask us through the resources hub.