What we built, and what we haven’t.
opsnite is a compliance platform, so this page has to hold up. Here is the security in the product today, and the vendor paperwork we don’t have yet.
What we have today.
Tenant isolation
Single-tenant by design. Each customer gets its own container service and its own Postgres database on AWS (ECS Fargate, RDS, S3). There is no shared database where one tenant’s rows sit next to another’s.
Identity and access
Per-tenant single sign-on over OIDC, with presets for Microsoft Entra ID and Google plus generic OIDC. Signature, issuer, audience, expiry, nonce and state are all checked. Role-based access inside the app. No SCIM provisioning yet.
First admin
No default password ships. The first admin is created with a one-time setup token: 32 random bytes, stored only as a SHA-256 hash, single use, expires after 72 hours.
Audit log
Audit events are hash-chained with SHA-256 over their canonical fields, so an edited or deleted event breaks the chain and shows.
Sessions and requests
Session secrets are minted per deployment, and the app refuses to start in production without them. CSRF protection, rate limiting, and secret checks that fail closed. Unauthenticated API calls return a 401.
Data at rest
Stored with AWS RDS and S3 encryption. Per-tenant customer-managed keys for that data are not offered today. Audit-pack PDFs can be signed with AWS KMS or a signing command you supply.
AI and air-gapped mode
The AI provider is chosen per deployment: Anthropic by default, Ollama, or any OpenAI-compatible endpoint you host. An air-gapped mode flag keeps a deployment off external AI entirely.
Regions and patching
Deployments have run in two AWS US regions. No EU region has been deployed yet. One fix can be rolled across every customer deployment at once, scoped by module if needed.
No audit reports yet. Here’s the rest.
opsnite has no SOC 2 report, no ISO 27001 certificate and no third-party pen test. That’s stated here so you don’t have to find it out in procurement.
SOC 2 report
Noneopsnite has no SOC 2 report and no auditor engaged. The product helps you run a SOC 2 program; we haven’t been through one ourselves. We will say so here until that changes.
ISO 27001 certificate
NoneNo certificate and no certification body engaged.
External penetration test
None yetNo third-party pen test of opsnite has been done. Our own scan engines and validation runs are not a substitute, and we don’t present them as one.
Product security controls
ShippedHash-chained audit events, per-tenant OIDC single sign-on, a one-time setup token instead of a default password, per-tenant session secrets, CSRF protection, rate limiting, and secret checks that fail closed. Unauthenticated API calls get a 401.
Tenant isolation
ShippedEach customer gets its own container service and its own Postgres database on AWS. Isolation is at the stack, not a tenant_id column.
Customer-managed keys
PartialData at rest uses AWS RDS and S3 encryption. Per-tenant customer-managed keys for that data are not offered today. AWS KMS is used to sign audit-pack PDFs, and you can supply your own signing command instead.
How the product itself was tested, engine by engine, is on the verification page.
Who touches your data.
An air-gapped deployment with a self-hosted model uses AWS alone.
Found something? Tell us.
Email security@opsnite.com with the details. We aim to acknowledge within one business day and to tell you what we’re doing about it.
There is no paid bug bounty. With your permission, we’ll credit researchers who report real issues.
Have a specific security question?
We answer in writing, and we say so when the answer is no.