®01
Data platform for precision farming
Data platform with connected machine, weather and satellite data
More on thisIndustries / Agriculture
Connected farming. Secure data.
Securely connect field data, connected machinery and supply chains.
Consulting. Integration. Operations.
Built around your industry.
- Farms and agricultural contractors
- Cooperatives and grain merchants
- Food processors and dairies
- Machinery and sensor manufacturers
Your priorities
Understand the challenge. Shape the solution.
We bring sensor, machine, and weather data together in one data platform, integrate traceability into ERP and supply chain, and secure IoT sensors, networks, and remote access.
02
Security for IoT sensors and farm networks
Network plan with zones, conduits and firewall rule set
More on this03
Cloud platform with data sovereignty
Platform architecture with data storage in Germany
More on thisFrom strategy to implementation
Six service modules
Six fields of expertise. Explore the scope that fits your project.
01Data platform for precision farmingISOBUS (ISO 11783) · agrirouter · Sentinel-2
Our approach
Precision farming manages each field zone by its actual needs and requires soil, machine, weather and satellite data in one place. We read machine data over ISOBUS, the data standard of farm machinery, and the agrirouter exchange service. We merge it per field with Sentinel-2 imagery and weather data in one data platform. On this basis we train models for yield forecasting, irrigation planning and early detection of crop diseases. Every model gets a version, a validation report and documentation so that advisors and farm managers can trace how a recommendation is made.
Full scope
- Connection of machine data via ISOBUS task data (ISOXML), agrirouter and the portals of farm machinery manufacturers
- Satellite data from Sentinel-2 with vegetation indices such as NDVI, weather data from the German Meteorological Service and soil samples per field
- Data platform with Delta Lake on Kubernetes, field records as spatial data in PostGIS
- Models for yield forecasting, irrigation demand and disease pressure, validated against harvest data from previous years
- Model operations with MLflow: versioning, data drift monitoring, retraining after harvest, documentation per model version
An arable farm merges yield maps from several generations of combine harvesters with satellite data; the fertilizer recommendation per field zone comes from a documented model instead of the manufacturer portal.
What you get
- Data platform with connected machine, weather and satellite data
- Versioned models with validation report per field
- Operations manual for data maintenance and retraining
02Supply chain traceabilityGS1 EPCIS 2.0 · GTIN and GLN · SAP S/4HANA
Our approach
The General Food Law, Regulation (EC) No 178/2002, obliges every business in the food chain to know the supplier and the recipient of every batch. Retailers and certification schemes such as QS or GlobalG.A.P. demand this evidence digitally and within a few hours. We integrate batch, origin and treatment data from farm software, warehouse and laboratory into your ERP system, the central business software. Buyers receive it over the GS1 standards GTIN, GLN and EPCIS. Every interface is versioned, tested and logged so that a recall can be narrowed down to the affected batches.
Full scope
- Data model for batches, origin, treatment and quality under the GS1 Global Traceability Standard with GTIN, GLN and batch number
- Integration into SAP S/4HANA or Microsoft Dynamics 365 and connection of farm software, warehouse management and laboratory data
- EPCIS 2.0 events and EDI messages under EDIFACT for dispatch advices to retailers and processors
- Audit records for QS, GlobalG.A.P. and organic certification bodies generated from the live data set
- Recall and blocking process with batch tracing forward and backward across all stages
A producer cooperative replaces binders of delivery notes with batch data in the ERP; a retailer's question about one batch is answered by the warehouse from the system instead of the archive.
What you get
- Batch and origin data model in the ERP
- Tested interfaces to retail, laboratory and farm software
- Recall process with evidence for QS and GlobalG.A.P.
03Security for IoT sensors and farm networksIEC 62443 · MQTT over TLS 1.3 · X.509 device certificates
Our approach
Milking robots, feeding systems, irrigation controllers and greenhouse climate computers are automation technology and need protection under IEC 62443, not office-grade security. We divide farm networks into zones, harden devices and replace factory passwords with device certificates that serve as digital identities. MQTT connections of the sensors and remote access by manufacturers are secured with TLS and access control. Monitoring makes attacks on field equipment visible and reports them to your security team or to OTOKO®. For device certificates and keys we operate a PKI whose root key is held in a hardware security module.
Full scope
- Inventory of all sensors, controllers, gateways and cellular connections with risk assessment under IEC 62443-3-2
- Zones and conduits for barn, greenhouse, irrigation and office, firewall rule set and remote maintenance through controlled access
- Device hardening with firmware updates, shutdown of open services and X.509 device certificates instead of factory passwords
- MQTT secured with TLS 1.3, key management for LoRaWAN and NB-IoT, PKI with the root CA in an HSM
- Monitoring of field equipment with anomaly detection, alerting and connection to a SIEM such as Microsoft Sentinel
A dairy farm separates milking robots and feeding from the office network; the manufacturer's remote maintenance now runs only through an approved access path with a log.
What you get
- Network plan with zones, conduits and firewall rule set
- Hardened devices with certificates and update process
- Monitoring with alerting and reporting templates
04Farm applications that work offlineProgressive web app · PostGIS · OpenID Connect
Our approach
In the field and in the barn there is no reliable cellular coverage. Still, that is where the documentation for the fertilizer ordinance, GlobalG.A.P. and the IACS application for EU farm subsidies is created. We develop and operate applications that keep working on tablets and terminals without a connection and sync entries at the next contact with the network. Field records, crop protection and fertilizer documentation, working hours and batch capture run in one interface with login over OpenID Connect, the standard for secure sign-in. Operation, updates and support of the application stay with OTOKO®.
Full scope
- Functional concept with your workflows for sowing, crop protection, fertilizing, harvest and batch capture
- Offline-first architecture as a progressive web app with local data storage and conflict resolution
- Field records with geometries in PostGIS, import from IACS application data and ISOBUS task data
- Exports for the fertilizer requirement calculation under the fertilizer ordinance and for the GlobalG.A.P. audit straight from the farm data
- Operation, monitoring, updates and support of the application with maintenance windows outside sowing and harvest
A vegetable grower records crop protection measures at the edge of the field on a tablet; pre-harvest intervals are checked automatically and the GlobalG.A.P. report comes from the same data.
What you get
- Farm application with offline sync
- Field records with import and export interfaces
- Operations and support agreement with update plan
05Cloud platform with data sovereigntyKubernetes · Terraform · Azure IoT Hub
Our approach
Farm, yield and position data reveal the cropping strategy and profitability of a farm. Under the EU Data Act, the law on data from connected products, that data belongs to the user of the machine and not to the manufacturer. We build a platform that pre-processes data at the farm on an edge gateway, a small computer on site. The data is then consolidated in a German data center or a hyperscaler region in Germany. Encryption, roles, releases to advisors, cooperative and authorities as well as deletion periods under the GDPR are part of the platform. Backup and recovery are tested before the harvest season starts.
Full scope
- Target architecture with edge gateway at the farm, message broker and data storage in Germany, provider and region chosen by data class
- Infrastructure as code with Terraform, operation on Kubernetes, sensor connection over Azure IoT Hub or AWS IoT Core
- Role and release concept for advisors, contractors, cooperative and authorities with a log of every data transfer
- Implementation of the data access rights under the Data Act and the deletion periods under the GDPR for employee and position data
- Backup and recovery with Veeam, rehearsed before the harvest season, cost control per farm and tenant
An agricultural contractor pools machine data from several customers on one platform in Germany; each farmer sees only their own fields and releases them selectively to their advisor.
What you get
- Platform architecture with data storage in Germany
- Role and release concept with log
- Tested backup and recovery concept
06KRITIS and NIS2 implementation for the food chainISO 27001 · BSI IT-Grundschutz · BSI Act and NIS2
Our approach
In Germany the food sector counts as critical infrastructure, whose failure endangers supply. NIS2, the EU directive on cybersecurity, obliges food production, processing and wholesale from medium company size upward. We check whether your company reaches the thresholds and prepare a risk analysis and an action plan. We set up reporting processes to the BSI, the German Federal Office for Information Security, and build a management system under ISO 27001 or BSI IT-Grundschutz. Management receives training and evidence, because under NIS2 it has to approve and supervise the measures itself.
Full scope
- Applicability check under the BSI Act and NIS2 by sector, company size and relevance to supply, documented for management
- Risk analysis across production, cold chain, warehouse, logistics and IT providers with an action plan based on current technical standards
- Reporting process with early warning, incident notification and final report within the BSI deadlines, rehearsed in scenario exercises
- Information security management system under ISO 27001 or BSI IT-Grundschutz with emergency plans for harvest and processing periods
- Supplier management with security requirements for machinery, software and logistics partners, training for management
A dairy finds that it falls under NIS2; risk analysis, reporting process and emergency plan for raw milk collection are in place before the first audit date.
What you get
- Applicability check and risk analysis with action plan
- Reporting process with templates and exercise log
- ISMS documentation with evidence for auditors
Typical project situations
Where change becomes tangible.
A specific challenge is often the starting point. These examples connect a typical situation with a possible approach and the intended result.
Illustrative situations, not customer references.
01 / Agriculture
Data platform at an arable farm
Yield maps, soil samples and satellite data sit in separate portals, fertilizer recommendations come from experience and the manufacturer portal.
Solution
Data platform with ISOBUS and agrirouter connection, Sentinel-2 analysis per field, documented model for fertilizer demand and irrigation.
Recommendations per field zone with a traceable derivation, fertilizer documentation from the same data, model maintenance after every harvest.
02 / Agriculture
Traceability at a producer cooperative
Batch and origin records sit in binders of delivery notes, retailer requests about recalls take days, the QS audit is approaching.
Solution
Batch data model under GS1 in the ERP, connection of warehouse, laboratory and farm software, EPCIS events and EDI dispatch advices to retailers.
Batch questions answered from the system, recall narrowed down to affected deliveries, audit records from the live data set.
03 / Agriculture
NIS2 at a food processor
The company crosses the NIS2 threshold, production control and office network are not separated, remote maintenance runs uncontrolled, a reporting process is missing.
Solution
Applicability check, risk analysis, IEC 62443 zones for production, controlled remote maintenance, reporting process and ISMS under ISO 27001.
Evidence for management and the BSI, separated networks without a production stop, rehearsed reporting process.
Working together
A clear path. With your team.
From an initial assessment to ongoing operations, we agree on priorities, responsibilities and the results of each stage.
How we work
- 01
Assessment
Data sources, field equipment, interfaces and regulatory obligations of the business
Prioritized list of measures, device inventory, applicability check for KRITIS and NIS2 - 02
Concept
Target architecture, zones, data model and operating model
Target architecture, network plan, interface catalog, operating model, schedule around sowing and harvest - 03
Implementation
Platform, interfaces, network separation and applications in stages
Integrated systems, tested under field conditions, documentation and acceptance per stage - 04
Operations
Monitoring, updates, audits, knowledge transfer
Monitoring, model retraining after harvest, audit support, stepwise handover
Before our first conversation
You do not need all the answers yet.
Start with a concrete challenge. These four questions help us find the right direction together.
Book a first consultation- 01
What should change?
Your current challenge and the outcome you are aiming for.
- 02
Which systems are involved?
An overview of sites, applications and interfaces.
- 03
What sets the boundaries?
Project dates, maintenance windows and known dependencies.
- 04
Who needs to be involved?
The right people from IT, security and operations.
Background & decision criteria
What are IT solutions for agriculture?
Six fields of action from the precision farming data platform to the evidence KRITIS and NIS2 require, planned, integrated and operated by OTOKO®. They serve farms, cooperatives and processors, and we schedule rollouts around sowing and harvest. The entire solution runs in German data centers.
IT solutions for agriculture bring field, machine and farm data together, prove the origin and treatment of every batch and protect the connected technology in barns, greenhouses and fields. OTOKO® covers six fields of action: a data platform for precision farming, meaning site-specific management of field zones, supply chain traceability and security for IoT sensors and farm networks. Added to these are farm applications that work offline, a cloud platform with data sovereignty and KRITIS and NIS2 implementation for the food chain.
The difference from a pure consulting project lies in operations and evidence. Every interface, device and model comes with documentation, a version and the records that auditors for KRITIS, NIS2 and the GlobalG.A.P. certification ask for. The entire solution runs in German data centers. We schedule rollouts for the time between harvest and sowing so that no new system lands in the busiest weeks.
Why OTOKO® for agriculture
- Cryptography and HSM
Cryptography and hardware security modules are our core competence. Device certificates for sensors, signed batch records and the keys of your platform are therefore held in certified devices instead of configuration files.
- German data centers
The entire solution runs in German data centers. That applies from the edge gateway at the farm to the data platform and the field records.
- Critical infrastructure and regulated industries
We work with operators of critical infrastructure and regulated industries. We know from practice what the BSI, certification schemes and retailers expect from the food chain.
- One team through to operations
One team accompanies you from consulting to operations. Data engineers, integration developers and OT security specialists stay on board after the rollout, without handover to third parties.
Delivery and details
Typical starting point before an agriculture project
Most farms and processors do not fail on technology but on isolated systems, unprotected field equipment and evidence that is pieced together only when the audit comes.
01
Data locked in manufacturer portals
Tractor, drone, weather station and soil probes deliver data to their own portals and formats, and nobody can analyze them together for a single field zone.
02
Traceability on paper
Delivery notes, batch numbers and treatment records sit in binders and spreadsheets, and every request from a retailer costs days.
03
Field equipment with factory passwords
Sensors, controllers and cameras run with factory passwords and outdated firmware, the device software, and are reachable directly from the internet over cellular networks.
04
NIS2 without an owner
The company reaches the thresholds, but there is neither a risk analysis nor a reporting process, and management can be held personally liable.
Three operating models
| On-Premises | German cloud | Hyperscaler | |
|---|---|---|---|
| Data location | Server at the farm or in the company data center, edge gateway per site | Data centers in Germany, operated under ISO 27001 | Azure, AWS or Google Cloud, Germany region selectable |
| Operation | Your team or OTOKO® as managed service | OTOKO®, with processing agreement and audit rights for your company | Shared, IoT and platform services by the provider |
| Tools | Edge gateway, MQTT broker, PostGIS, local field records | Hosted data platform, PKI and backup in Germany | Azure IoT Hub, AWS IoT Core, managed data services |
| Suited for | Barn and greenhouse equipment, farms with weak connectivity | Cooperatives and processors that need data sovereignty | Satellite analytics, models, load peaks during harvest |
| Compliance | Full control, evidence from your ISMS | Processing agreement under GDPR, location Germany, supplier evidence for NIS2 | Processing agreement, standard contractual clauses, exit scenario per service |
Collaboration
Project
Clearly scoped undertaking such as a data platform, a traceability interface or the NIS2 implementation with a defined result, milestones, acceptance and dates outside the seasonal peaks.
- Assessment, concept, implementation, handover
- Fixed price or effort by milestone, dates planned around sowing and harvest
- Suited for platform builds, audit preparation and network separation
Team reinforcement
Data engineers, integration developers or OT security specialists work in your teams, with your tools and in your release processes, scalable by season.
- Onboarding into your farm workflows, systems and audit requirements
- Scalable by season and project progress
- Suited for cooperatives and processors with their own IT and capacity gaps
Managed service
OTOKO® operates the data platform, farm application or the monitoring of field equipment with agreed service levels, reports and the evidence NIS2 requires from providers.
- Monitoring, updates, backup and support
- On-call during sowing and harvest
- Suited for farms and processors without their own IT team
Standards and evidence
What each regulation in the food chain requires and what OTOKO® delivers for it.
| Requirement | Demands | OTOKO® delivers |
|---|---|---|
| KRITIS (food sector) | For operators of critical facilities in the food industry above the thresholds of the BSI KRITIS ordinance: measures based on current technical standards, attack detection, evidence to the BSI and reporting of significant disruptions | Applicability check, risk analysis, attack detection for production and IT, evidence documentation and reporting process |
| NIS2 | Risk management, reporting of significant security incidents within staged deadlines, supply chain security, training and approval of the measures by management | Action plan, reporting process with templates, security requirements for suppliers, training and evidence for management |
| GDPR | Legal basis and purpose limitation for employee, position and customer data, processing agreements, deletion periods and data subject rights | Data protection concept for platform and applications, role and deletion concept, processing agreement with location Germany |
| ISO 27001 | Information security management system with risk assessment, controls, supplier management and regular review | ISMS setup or extension to field equipment and platform, operation of our services under ISO 27001, records for the audit |
| IEC 62443 | Zones and conduits, security levels per zone, hardening of controllers and components and secured remote maintenance for automation technology | Network plan with zones for barn, greenhouse and processing, hardened devices, controlled remote access, monitoring |
FAQ
Good questions. Clear answers.
15 answers about your industry, the project and ongoing operations.
Industry & expertise6 questions
Which IT solutions for agriculture does OTOKO® offer?
The portfolio covers data platforms for precision farming, supply chain traceability under GS1 and the protection of IoT sensors and farm networks under IEC 62443. Added to these are farm applications that work offline, cloud platforms with data storage in Germany and the implementation of KRITIS and NIS2. Each field of action can be commissioned on its own or as a package, on request with operation by OTOKO®.
Does our business fall under KRITIS or NIS2?
That depends on sector, company size and relevance to supply. Primary producers rarely fall under them, while processors, dairies, mills and wholesalers from medium company size upward often do. Operators of critical facilities in the food industry are additionally subject to the BSI Act. We review the classification with you, document the result for management and derive the specific measures required.
How secure are cloud platforms for farm and yield data?
Cloud platforms can be operated with encryption, roles, releases and logging so that farm and yield data is accessible only to the people you authorize. What matters are clear rules about who may see and share which data, and a contract that fixes location and deletion. The entire solution runs in German data centers.
Can field equipment be secured without interrupting operations?
Yes. Network separation, monitoring and controlled remote maintenance can be introduced during ongoing operations. Interventions on the controllers of milking robots, feeding or irrigation are scheduled outside barn hours and outside sowing and harvest. We work with operators of critical infrastructure and regulated industries. This approach is standard there.
Who owns the machine data and how do we get access to it?
The EU Data Act gives the user of a connected product the right to access the data it generates and to share it with third parties. It obliges manufacturers to provide that access. We connect manufacturer portals, agrirouter and ISOBUS data to your platform. The data sits with you and every release to an advisor or contractor is logged.
What happens if an attack on the IT hits during harvest?
For this case there is an emergency plan with priorities for intake, cold chain and delivery, rehearsed recovery steps from a verified backup and a reporting process that meets the BSI deadlines. In the managed service OTOKO® takes over on-call duty and recovery, and the farm applications keep working offline until the platform is reachable again.
Getting started & delivery5 questions
Can we start with a single area of expertise?
Yes. We can scope a specific task first. We consider its interfaces with the rest of your infrastructure and agree which work is included before implementation.
What should we prepare for the first conversation?
A brief description of the challenge, the systems involved and your desired outcome is enough to start. Known deadlines and the relevant contacts are helpful. Please do not include credentials or confidential system documentation in an initial enquiry.
Who needs to participate in the project?
Security architect: Target architecture, IEC 62443 zones, evidence. Data engineer: Data platform, machine and satellite data, models. Integration developer: ERP interfaces, GS1 records, farm software. Application developer: Farm applications, offline sync, support. Compliance consultant: KRITIS, NIS2, GDPR, audit records. Project lead: Milestones, seasonal planning, acceptance, reporting.
How do you determine the schedule and effort?
We consider the systems, interfaces, available documentation and operational constraints. An agreed scope and milestones provide the basis for estimating effort. A fixed duration without these details would not be reliable.
What does the first stage deliver?
Data sources, field equipment, interfaces and regulatory obligations of the business Prioritized list of measures, device inventory, applicability check for KRITIS and NIS2
Operations & development4 questions
How can we work together?
Project: Clearly scoped undertaking such as a data platform, a traceability interface or the NIS2 implementation with a defined result, milestones, acceptance and dates outside the seasonal peaks. Team reinforcement: Data engineers, integration developers or OT security specialists work in your teams, with your tools and in your release processes, scalable by season. Managed service: OTOKO® operates the data platform, farm application or the monitoring of field equipment with agreed service levels, reports and the evidence NIS2 requires from providers.
What happens at handover to operations?
Monitoring, updates, audits, knowledge transfer Monitoring, model retraining after harvest, audit support, stepwise handover
Can we expand to further sites or systems later?
We can account for future expansion in the initial concept. Documented interfaces and reusable rules provide a foundation. Each additional site or system still needs to be assessed for its particular requirements.
How do we keep the solution maintainable?
Agree responsibilities, recurring tasks and change procedures alongside the technical implementation. Documentation and knowledge transfer help your team operate the solution. The specific activities and any ongoing support are part of the agreed scope.
Agriculture
Let's discuss your next step.
Let us work out together how you can bring field data, supply chain, and sensors together securely in your business.
Book a first consultation
