Ship governed plant and quality workflows without touching the ERP core

For machinery and plant engineering, automotive suppliers, process manufacturers and multi-plant Mittelstand groups: build deviation handling, engineering change, supplier onboarding and compliance evidence as production software with review points, traceability and code ownership.

Modernise around SAP, MES, PLM and QMS while the core system migration runs. Nothing we build lands in your ERP customisation backlog.

Where it runs

Nuclicore-managed single tenant on Hetzner in Germany or Azure in the EU, or your own cloud (BYOC) and on-premise on Enterprise.

What it connects to

ERP (SAP ECC and S/4HANA, proALPHA, abas, Infor and others) via APIs, file exchange and database views. MES, historian and quality data via the exports and gateways you already run.

Who owns the code

You do. Each app is a standard React and Node repository with its own backend, running on a managed, encrypted Postgres database. Export it at any time.

How changes ship

Preview, Test and Production per app, with approval before every release, redeploy of any earlier release and one release per plant, brand or legal entity.

What manufacturing teams evaluate first

These are the questions the plant IT lead, the quality manager and the works council ask before a pilot gets a budget line.

Hosting in Germany

Nuclicore-managed on Hetzner in Germany or Azure in the EU, with BYOC or on-premise on Enterprise. No data leaves the EU unless you decide otherwise.

Clean core, not more Z-code

Every workflow runs as a side-by-side application against ERP interfaces. Your S/4HANA programme keeps its customisation freeze and its go-live date.

No direct access to the shop floor network

We do not connect to PLCs or the OT network. Apps consume what your MES, historian, OPC UA gateway or quality system already exports. Your OT segmentation stays as it is.

Audit trail your auditors can read

Who raised, who reviewed, who approved, when, with what evidence. Exportable per record for ISO 9001, IATF 16949, VDA 6.3 and customer audits.

Evidence for NIS2 and CRA

Dependency scanning, secrets handling, CVE patching and a nightly ZAP scan run on every app. Release gates and logs give you documented measures for supply chain security questionnaires.

Roles per plant and per role

RBAC per app with plant, department and role scopes. Quality sees quality, purchasing sees suppliers, the works council gets the access concept in writing.

Exit without a rewrite

Standard code, standard database, documented interfaces. Procurement gets an exit path before signature, not after.

Built for real manufacturing operating models

Align scope, workflow ownership and governance for the segment you operate in.

Machinery and plant engineering

Automotive suppliers (Tier 1 and Tier 2)

Process, chemicals, food and packaging

Multi-plant Mittelstand groups

Why delivery models are changing in manufacturing

The plants that ship fastest keep the ERP core clean, move exceptions out of Excel and treat compliance as running software.

Common Reality

The ERP migration eats the IT roadmap until 2027

Mainstream maintenance for SAP ECC ends in December 2027. Migration projects take 12 to 24 months and come with a customisation freeze. Every business request that is not part of the migration waits.

Common Reality

Regulation lands on the shop floor as evidence, not as slides

NIS2 has applied since December 2025, CRA vulnerability reporting since September 2026, the new product liability regime from December 2026, the Machinery Regulation from January 2027. Each one asks who did what, when, with which evidence.

Common Reality

Excel is the real MES extension

Deviations, change requests, supplier certificates and audit actions live in spreadsheets and mail threads. That works until the auditor asks for the approval chain, or the person who owns the file leaves.

What you can build across quality, production and supply chain

Deliver governed software around your systems of record, with review points, traceability and code ownership.

Quality and compliance

Deviations, NCRs and 8D reports

Capture nonconformities from the line or the customer, route to the owner, track containment, root cause and closure with deadlines and evidence.

CAPA with effectiveness check

Corrective and preventive actions with owners, due dates, a verification step and a link back to the originating deviation or audit finding.

First-sample and PPAP submissions

Document completeness per submission level, reviewer sign-off and a record of what was sent to which customer and when.

Field incident and product liability register

Log field complaints and safety-relevant incidents, assess, decide on measures and keep the decision record the new product liability regime will ask for.

Production and maintenance

Maintenance requests and work orders

Shop floor raises the request on a tablet, maintenance prioritises, executes and closes, with parts used and downtime recorded against the asset.

Shift handover and downtime log

Structured handover per line with open issues, downtime reasons and escalations that survive the shift change.

Deviation permits and temporary approvals

Time-limited permission to run outside specification, with the approver on record and automatic expiry.

Changeover and start-up checklists

Version-controlled checklists per product and line, completed on the device, stored per batch or order.

Supply chain, engineering and trade

Impact review across design, purchasing, production and quality before the change is released to the ERP and PLM.

Supplier onboarding and self-assessment

Qualification questionnaires including NIS2 supply chain, ESG and CBAM data, document collection with expiry, and approval by purchasing and quality.

Export control and sanctions checks

Dual-use classification, end-use declarations and sanctions screening as a checklist with an approval record per order.

CRA vulnerability intake and reporting

Receive reports on your products, triage, track the 24-hour, 72-hour and 14-day reporting steps and document the fix and the customer notice.

Fits your systems of record

Most ROI comes from removing manual handoffs between the line, quality, purchasing and engineering, and from connecting to the ERP with clear ownership of every interface.

We build governed workflows around ERP, MES, PLM, QMS, document management and data warehouses. We read what these systems expose and write back through their supported interfaces. We do not touch PLCs, safety controllers or the OT network.

What we need from you

Integration patterns supported

Governed releases, stable production

Security and data controls for manufacturing

Each application runs its own backend, with a managed, encrypted Postgres per environment. Single-tenant infrastructure, BYOC and on-premise on Enterprise. Hosting in Germany or the EU by default.

RBAC, audit logs and monitoring keep access controlled per plant and role. Dependency scanning, secrets handling, CVE patching and a nightly ZAP scan run on every app, which gives you documented technical measures for NIS2 and for customer security questionnaires. Your workspace content is not used to train models.

Security controls in practice

What a first manufacturing pilot looks like

We align on one approval-heavy workflow and deliver reviewable increments with clear governance.

Scope, acceptance criteria, architecture outline

Pick one workflow (for example deviations and 8D, engineering change or supplier onboarding). Define roles, approval matrix, the ERP fields to read and the records to write back.

First working version in Preview

Forms, routing, approvals and the read integration to your ERP or quality exports. Quality and plant users click through and comment in the task.

Test environment with real roles and real data

Plant roles, SSO if applicable, write-back to the ERP or DMS, audit trail export. Your IT reviews the interface and the access concept.

Production release and handover

Approval, release to Production, redeploy of an earlier version verified. Documentation for IT, quality and the works council. Decision on the next workflow.

Success criteria examples

Manufacturing FAQ

Answers for plant IT, quality management and purchasing.

What does "governed" mean for plant and quality workflows?

Work is organised into reviewable tasks with acceptance criteria. Releases move through Preview, Test and Production with approval, and any earlier release can be redeployed. Every record carries who raised, reviewed and approved it, with timestamps and evidence. That is the trail ISO 9001, IATF 16949 and customer auditors ask for.

We are in the middle of an S/4HANA migration. Can we still build?

Yes, and that is the typical starting point. Apps run beside the ERP against stable interfaces, not inside it. Nothing lands in the customisation backlog, and when the migration switches interfaces from ECC to S/4HANA the app is repointed, not rebuilt.

Do you connect to our PLCs or MES directly?

No. We do not touch the OT network, PLCs or safety controllers. Apps consume what your MES, historian, OPC UA gateway or quality system already exports through IT-side interfaces you approve. Your segmentation and your OT security concept stay untouched.

Can the audit trail be used in an IATF 16949 or VDA 6.3 audit?

The audit trail records every action per record with user, timestamp and evidence, and can be exported per record or per period. Auditors read the trail; the certification itself remains the scope of your quality management system.

Does this help with NIS2?

In two ways. The apps themselves run with dependency scanning, secrets handling, CVE patching, nightly ZAP scans and audit logs, which gives you documented technical measures for the applications you build. And supplier onboarding with security questionnaires and evidence tracking is one of the first workflows plants build.

We are a machine builder. Does this cover the Cyber Resilience Act?

It covers the process side: vulnerability intake for your products, triage, the 24-hour, 72-hour and 14-day reporting steps, the fix record and the customer notice. The CRA conformity of your machines and their embedded software remains the responsibility of your product engineering.

Can it run on-premise or in our own Azure tenant?

Yes. BYOC and on-premise deployment are available on Enterprise. The default is Nuclicore-managed single tenant on Hetzner in Germany or Azure in the EU.

We have six plants with different approval rules. One app or six?

One app, one codebase, one release. Plant-specific fields, approvers and thresholds are configuration, not code. Deployment labels let you release per plant or legal entity when a plant needs a different cutover date.

Who owns the code and the data?

You do. Each app is a standard React and Node repository with its own backend, running on a managed, encrypted Postgres database. You can export the code and the data at any time and run it yourself. Procurement gets the exit path before signature.

Who maintains the app after the pilot?

Your team, through the same platform: describe the change, review the task, approve the release. Security patches to dependencies are applied by the platform. If you want to take the code and maintain it in-house, you can.

What is not a fit?

Real-time control, safety functions, anything that has to live on the OT network, and replacing the ERP or MES themselves. Nuclicore builds the governed workflows around these systems, not the systems.

Move plant and quality workflows out of Excel and into governed software.

Ship beside your ERP migration, with audit trail, security controls and code you own.