What Started

IT and security

How What Started connects

What Started is a web service. Nothing is installed on your servers and nothing in your plant has to accept connections from outside. Every device in the plant starts its own outgoing HTTPS connection to What Started, the same way a browser opens a website. For the exact hosts and ports to allow, see Firewall and network requirements.

The whole picture

How What Started connects Browsers, TV screens and phones at QR stickers on the office network, Wi-Fi or mobile data, and the What Started Agent and PLCs on the plant network, all open HTTPS connections through the firewall to whatstarted.com. Browsers also connect to the live update service. What Started sends signed webhooks to your URL and alert emails to your team. OFFICE NETWORK, WI-FI OR MOBILE Browsers and TV screens The app, the board and reports Phones at QR stickers Operators log stops PLANT NETWORK What Started Agent On a PC next to a machine PLC, gateway or script Sends pings and counts FIREWALL: HTTPS, TCP 443 WHAT STARTED, ON THE INTERNET Live updates and downloads *.supabase.co whatstarted.com App, operator pages, read API, pings and agent pairing SENT BY WHAT STARTED Your webhook URL Signed HTTPS POST Alert emails To your team
Arrows show which side opens each connection. People and screens do not need to be on the plant network.

The parts

Part Where it runs What it does
Web app whatstarted.com, in any current browser The board, machine pages, reports, settings and TV screens. Owners, admins, members and operators sign in here.
Operator pages whatstarted.com, opened from a QR sticker An operator scans the sticker with a phone and logs why the machine stopped. See QR stickers.
Ping API whatstarted.com/api/v1/ping Machines say they are alive and send status and counts, each with its own token. See Send pings.
What Started Agent A Windows or Linux PC next to the machine Pairs with one machine by code and sends its pings, so no programming is needed. See the agent.
Live updates Our database provider, at an address on supabase.co Pushes each new ping and status change to open boards and machine pages, so they change without a refresh.
Read API whatstarted.com/api/v1 Your ERP, MES or BI tool reads machines, events, metrics and OEE with an API key. See Read API.
Webhooks Sent from What Started to a URL you choose Tells your system the moment a machine goes down or an alert opens. See Webhooks.
Alert emails Sent from What Started to your team No signal, down, not producing and out of range alerts. See Email alerts.

Your plant's data is stored by What Started in the United States. The services that process it for us are listed under Privacy and terms.

The agent on a plant PC

The What Started Agent on a plant PC A browser on the same PC opens the agent's setup page at localhost port 47100, which only that PC can reach. The agent makes outgoing HTTPS connections on port 443 through the firewall to whatstarted.com. THE PC NEXT TO THE MACHINE Browser On this PC Agent A Windows or Linux service localhost:47100 This PC only FIREWALL whatstarted.com HTTPS 443, outgoing
The setup page never leaves the PC. The agent itself only talks to What Started.
  • The setup page listens on 127.0.0.1 only, port 47100 unless you change it in the agent's config.json. Other PCs on the network can't open it, so it needs no firewall rule.
  • The agent opens outgoing HTTPS connections to whatstarted.com to get a pairing code, collect its ping token and send pings. It never accepts connections from the network.
  • It does not read the PLC or write to the machine yet. It proves that the PC is on and can reach What Started.
  • The installer comes from the download page, which serves the files from our download storage on supabase.co.

What happens when a machine pings

  1. The PLC, script or agent sends an HTTPS request to https://whatstarted.com/api/v1/ping with the machine's token. The token works for that one machine only and can be revoked under the machine's settings.
  2. What Started checks the token and the plan's limits, records the status and counts, and answers 202.
  3. Open boards, machine pages and TV screens get the change through live updates within a second or two.
  4. If the machine went down, or later stops pinging, What Started opens an alert, emails the people who chose that alert, and sends a webhook to any URL that subscribed to it.

Security in short

  • Nothing inbound. No port forwarding, VPN or remote access into the plant. Devices only make outgoing HTTPS connections.
  • Encrypted. All traffic uses HTTPS with TLS 1.2 or newer. Plain HTTP is redirected to HTTPS and is not meant for pings.
  • One credential per job. Ping tokens work for one machine and can only send pings. API keys are read-only and belong to one plant. Webhooks carry a signature you can check. All of them are stored as hashes, shown once, and can be revoked at any time.
  • People sign in. Each person has their own account with a role: owner, admin, member or operator. Two-step sign-in with an authenticator app can be turned on under Settings → You. One plant can never see another plant's data; the database enforces that on every table.
  • No tracking. No advertising, analytics or tracking scripts run on the pages.