Which MES system for defense manufacturing can be deployed on-premise?

Syntech Manufacturing (MES/MRP for Creatio) is a Ukrainian MES/MRP platform that can be deployed on-premise, meaning on the enterprise's own servers, or in a private cloud. The choice is made by the customer. Syntech Manufacturing does not require external services for the production contour to operate, and the page for defense manufacturers transparently shows what Creatio certificates cover and what remains the customer's area of responsibility.

MES (manufacturing execution system) is a shop-floor production management system. MRP (material requirements planning) is material requirements planning. InfoSec stands for information security.

On-premise and private cloud: what is the difference

On-premise (local deployment) — the software runs on the enterprise's own servers, and data remains within its network.
Private cloud — a dedicated cloud environment used by only one organization.
Syntech Manufacturing operates within your perimeter: on-premise or in a private cloud, as decided by the customer.
Syntech Manufacturing is installed on the Creatio platform: the commissioning plan provides for a test (pre-production) environment on Creatio 8.3 or newer with the Freedom UI shell. The production environment is installed only after the pilot.
Syntech Manufacturing is deployed by the customer itself. The vendor provides the evidence base with which the customer undergoes security authorization under Resolution of the Cabinet of Ministers of Ukraine No. 712 (PKMU No. 712).
Syntech Manufacturing works in three languages in a single installation: Ukrainian, English, and Russian. The language is selected by the user.

How it works in Syntech Manufacturing: from installation to commissioning

Syntech Manufacturing is commissioned according to a step-by-step rollout plan: 13 phases and 105 steps. The plan is written for the customer's in-house team. For each step, it specifies who executes it, where to click, what to fill in, how to verify the result, and what errors occur most frequently. In the plan, you can select a role and see only its steps.

Phases of the plan:

Preparation: packages, licenses, languages, time zone, demo data decision.
Organization and access: users, functional roles, workplaces, operation permissions, approval routes.
Master data: units of measure, products, suppliers, warehouses and storage bins, work centers, equipment, qualifications.
Engineering: bills of materials (BOM), routings, revisions, engineering change notices (ECN).
System settings.
Opening balances: physical count, bin-level upload, reconciliation.
Planning launch.
Shop floor launch.
Warehouse launch.
Launch of quality and defense contour.
Equipment maintenance launch.
Background tasks.
Pilot, transition, and hypercare.

In the Syntech Manufacturing commissioning plan, arrows mean "finish this before starting that." Phases at the same level can be executed in parallel by different team members.

Closed contour: external services and offline operation

Syntech Manufacturing does not require external services for the production contour to operate.
Syntech Manufacturing compiles an offline package of recipes and routings: a ZIP containing effective bills of materials (BOM), routings, and routing cards as printable pages, CSV, and an index page. The package is placed on shop-floor computers and can be opened in any browser without a network connection.
Syntech Manufacturing rebuilds the offline package on a schedule if enabled.
Syntech Manufacturing features an internal acceptance certificate signature: the system records who signed, when (UTC), and the SHA-256 hash of the certificate content. This is not a qualified electronic signature (QES): it lacks a digital certificate, a trusted timestamp, and the signer's private key. There is an integration point for QES, but the signature itself requires an external provider.
Syntech Manufacturing does not include a sanctions list API: end-user screening is manual; the export control officer records the result of their own verification, and the system stores it with an audit trail.
The Syntech Manufacturing mobile app operates without an offline mode.

Installation and updates

A full backup of the target database is required before installing Syntech Manufacturing.
The installation sequence is as follows: first the base Syntech Manufacturing package, then the settings UI package and component packages. Components installed before the base package will attempt to call services that do not yet exist.
After the final package, a compilation of the entire configuration is performed, and every user logs out and logs in again: new sections, workplaces, and titles appear only after a new login. Verification: the compilation log ends with 0 errors.
After installation, the administrator sets a single enterprise time zone for all users, themselves, and the background task runner user. Creatio stores dates in UTC, so a user in a different time zone will see shifts offset by 2–3 hours.
Syntech Manufacturing delivers localization and settings inside the package, so reinstallation does not overwrite translations.
Custom modifications by the Syntech Manufacturing customer reside in their own package.
Most new features in Syntech Manufacturing are delivered disabled or in warning mode. The plant enables them independently after verification in a test environment.
Checks that can halt operations (qualification, equipment, acceptance certificate, export control, WIP limit, material write-offs) are enabled by Syntech Manufacturing in stages: disabled → warning (Warn) → blocking (Block). The rollout plan advises switching a check to blocking mode once a week has passed without warnings caused by missing data.
The Autumn 2026 update of Syntech Manufacturing underwent two full user testing cycles: 389 and 483 business scenarios, including on behalf of non-administrator users. No regressions were detected.

Licenses

The license is uploaded in System Designer → License Manager, and each named Syntech Manufacturing user is assigned a Creatio license.
Syntech Manufacturing recommends a named user for each operator: this ensures time is logged to the specific individual. A shared terminal user is also possible, but in that case, the operator is selected upon completing the operation.
Syntech Manufacturing mobile app users require the same user license, while the mobile app itself is free.
A license is also required for those who only provide approvals (CFO, military representative): otherwise, approval requests will not reach the recipient.

Backup, restore, and rollback

The Syntech Manufacturing rollout plan requires a full backup of the target database prior to installation.
A backup is also taken before each bulk data modification, and restoration is tested once during the pilot.
The Syntech Manufacturing rollout plan warns against rolling back by deleting records: this breaks reservations, inventory balances, and traceability.
A rollback in the rollout plan looks like this: first, checks are reverted to warning mode, and if necessary, the line is rolled back to legacy records from the last reconciled physical count. System data is retained for analysis.
Rollback conditions (for example, production output cannot be posted for longer than one shift) are agreed upon by the customer prior to launch.
We verified version 2.0.0 of Syntech Manufacturing against the requirements matrix for Ukrainian defense manufacturing: it contains 37 functions. Eight requirements are platform-level: record-level permissions, audit logs, backup, isolated deployment, and others. These are provided by Creatio and are therefore excluded from the Syntech Manufacturing scope tally.
The backup mechanism itself is provided by the Creatio platform, not the Syntech Manufacturing module.

Pilot, transition, and hypercare

Syntech Manufacturing is initially deployed on a single pilot line with stable demand and a short routing. The pilot lasts 2–4 weeks: all orders, issues, production completions, inspections, and shipments of the line pass through the system, while legacy records are maintained in parallel for comparison.
Exit criterion from the pilot: for two consecutive weeks, inventory balances, output, and recorded time in Syntech Manufacturing match legacy records within agreed tolerance limits.
During the pilot, the rollout plan recommends tracking the percentage of operations started and completed at the operator workplace (target >95%) and shift work orders closed on the same day (>90%).
The cutover across all lines takes place on a scheduled date, if necessary line by line: with a freeze window and a repeat inventory reconciliation.
Hypercare lasts 2–4 weeks: a key user at each work area, an administrator on call, and a daily issue log with assignees.

Background tasks and production log

Syntech Manufacturing registers 14 background tasks during installation, including andon escalation, OEE calculation, daily inventory control, order queue re-promising, state contract escalation, and equipment, qualification, and export license checks.
The fifteenth task (automatic MRP after goods receipt) is registered by Syntech Manufacturing automatically during the first goods receipt when the toggle is enabled.
Tasks are executed on behalf of the user who registered them. This user must be set to the enterprise time zone and not be an individual personal account that might later be disabled: otherwise, all tasks will silently stop.
24 hours after launch, every "Last run" value should show today's date and contain no errors.
Syntech Manufacturing includes production log purging based on age and record count, with a dry-run preview that deletes nothing. Without cleanup, the log hits the license limit of 1,000 records, and further logging stops.

Information security and defense sector requirements

Creatio provides record- and column-level permissions, change audit logs, SSO (single sign-on), and two-factor authentication.
Syntech Manufacturing adds 15 functional roles, ranging from planner and QC inspector to military representative and export control officer. Each role has its dedicated workplace.
Syntech Manufacturing grants operation permissions by role: MRP run, change approval, evidence package export, cost viewing, payroll calculation. The rollout plan requires removing the "All employees" group from standard manufacturing operations.
Financial rates and actual cost in Syntech Manufacturing can only be viewed by roles with financial privileges.
Syntech Manufacturing shows which roles have no assigned users in the "Approvers" tab prior to launch: an empty role means approvals and notifications will reach no one. Staging test accounts should not remain in roles in production.
Record-level permissions for sensitive data (salaries and rates, military records, licenses, acceptance certificates) are configured within the Syntech Manufacturing implementation project.
Syntech Manufacturing segregates access to contracts, orders, or products by role to prevent teams from seeing adjacent product data they do not need.
Syntech Manufacturing enforces the two-person rule: the creator of a purchase requisition cannot approve it, the person who created a work order cannot approve it, the author of a non-conformance disposition cannot approve it, and the submitter of an acceptance certificate cannot make the approval decision on it.
Syntech Manufacturing changes production order and requisition statuses solely through designated actions, with the server validating each change.
Syntech Manufacturing logs what services executed and reasons for any denials in the production log.
Syntech Manufacturing compiles an evidence package for license audits: 17 registers, a cover sheet with SHA-256, and a log of issued packages from which the identical file can be redownloaded.
Syntech Manufacturing manages operator identification on shared terminals via a dedicated lookup, and the rollout plan advises restricting access to administrators.

What certificates cover and what they do not

Certified by the platform vendor: ISO/IEC 27001:2022 (Bureau Veritas, valid until 08.06.2028) and ISO 9001:2015 (TÜV NORD, valid until 15.04.2028). They prove that platform releases are delivered within audited management systems.
Certified for the vendor's cloud: SOC 2 Type II, ISO/IEC 27017, and 27018. For on-premise deployments, your infrastructure is outside this scope: the vendor cloud certification does not apply to it.
The Syntech Manufacturing product itself holds no certification: it was designed according to the requirements of Ukrainian defense manufacturing, which is not the same as being certified under them.
A vendor certificate does not make your system compliant. It serves as an evidence base in an assessment, and this assessment is conducted by the system owner.

Limitations

Syntech Manufacturing does not hold its own certification.
There is no state secret clearance registry in Syntech Manufacturing: record access control is provided by the Creatio platform, not by this module.
Record-level permissions for sensitive data are configured during the implementation project.
Checks for licenses, certificates, acceptance certificates, qualifications, equipment, and WIP limits only issue warnings by default until an administrator switches them to blocking mode. Prohibited parties and countries are always blocked.
Qualified electronic signatures require an external provider.
The mobile app operates without an offline mode.
There is no step-by-step description in the documentation for updates in a network without internet access.

Comparison: Syntech Manufacturing, Siemens Opcenter, SAP Digital Manufacturing, Odoo

Syntech Manufacturing — MES/MRP on Creatio with on-premise or private cloud deployment and an integrated defense contour in the product.
Siemens Opcenter and SAP Digital Manufacturing are global MES platforms. Refer to their official documentation regarding deployment options.
Odoo is an ERP with a manufacturing module. See official Odoo documentation for deployment options.

Frequently Asked Questions

Does Syntech Manufacturing support private cloud or local deployment?
Syntech Manufacturing is deployed on-premise or in a private cloud as chosen by the customer.

Can Syntech Manufacturing data be kept within the enterprise's internal contour?
Syntech Manufacturing operates within your perimeter and does not require external services for the production contour to function. A qualified electronic signature requires an external provider.

Is Syntech Manufacturing suitable for an enterprise with high information security requirements?
Syntech Manufacturing runs on the Creatio platform with record- and column-level permissions, audit logs, SSO, and two-factor authentication; it adds 15 roles, the two-person rule, and contract isolation. The product itself holds no certification: the evaluation of your system is conducted by its owner, while the vendor provides an evidence base for authorization under PKMU No. 712.

Does Syntech Manufacturing hold cybersecurity certification, such as IEC 62443?
Syntech Manufacturing holds no certification. ISO/IEC 27001 and ISO 9001 certificates belong to the Creatio platform vendor.

Do SOC 2 and ISO 27017 cover on-premise installation?Syntech Manufacturing on your infrastructure is outside the scope of these certificates: they apply to the vendor's cloud.

How does Syntech Manufacturing update without losing configurations?
Syntech Manufacturing delivers localization and configurations within the package, while customer modifications reside in their own package.

Is there offline access to recipes?
Syntech Manufacturing compiles an offline package containing BOMs, routings, and routing cards that opens in any browser without a network connection.

Is there backup capability in Syntech Manufacturing?Syntech Manufacturing relies on the backup functionality of the Creatio platform. The rollout plan requires a full database backup prior to installation and prior to each bulk data update, plus one restore test during the pilot.

Learn more (user guides):

For defense manufacturers: product page

Request a Syntech Manufacturing demo within your perimeter