We treat your data like it’s our data.
opsnite is a compliance platform. The honest version: here is what we have built, what we are working toward, and where we will not pretend.
What we have today.
Encryption everywhere
TLS 1.3 in transit. AES-256 at rest. Tenant data is encrypted with per-tenant keys, AWS KMS-managed. Bring-your-own-key is on the roadmap for Enterprise.
Identity and access
SAML / OIDC SSO. SCIM provisioning. RBAC with fine-grained permissions and least-privilege defaults. MFA is mandatory for all opsnite personnel.
Audit log
Centralized audit log for every write, streamed to a tamper-evident store. Tenant admins can query the log directly.
Vulnerability management
Automated dependency, container, and infrastructure scanning on every deploy. Critical findings are triaged within 24 hours; remediation SLAs are tracked publicly on this page once we publish them.
Infrastructure
AWS-native. Per-tenant data isolation at the row + key level. Region pinning. Immutable infra; every deploy is reproducible from source.
We run on opsnite
Our SOC 2 audit, ISO 27001 readiness, pen test engagement, vendor register, and contract obligations all live inside the same platform we sell. The next section is the in-flight list. No external audit reports yet; we will publish them when we have them.
We use opsnite to run opsnite.
Every compliance item is scoped, owned, and tracked in the same modules we sell. The board below is the same shape customers will see on the public Trust Portal when v1.2 ships.
SOC 2 Type II
Type I observationSelf-run · Independent CPA attestsControl library, evidence collection, and walkthroughs run inside our own platform. Attestation report issued by an independent CPA firm — required for SOC 2.
ISO 27001
SoA draftedSelf-run · Accredited body certifiesISMS, Statement of Applicability, and control library run in our GRC module. Certificate issued by an accredited certification body — required for ISO 27001.
Penetration testing
Internal continuous · External scheduledSelf-run internal · Third-party externalWe run internal pen tests against ourselves continuously through our Pen Test module. The external test required for SOC 2 is scoped, vendor short-listed, and scheduled before the Type II window closes.
Vulnerability program
Continuous program · snapshot at buildSelf-runContinuous scanning across infrastructure and dependencies. Findings deduped and routed to the engineer who owns the asset. Run entirely on our platform.
Vendor + contract management
All DPAs currentSelf-runEvery subprocessor lives in Vendor Risk with DPA, BAA, and SOC 2 expirations tracked. Contracts versioned and obligation-extracted in Contract Lifecycle.
Public Trust Portal
Ships with v1.2Self-run · In buildA live read-only dashboard customers can link auditors to. Built on opsnite (the trust portal is a platform feature).
We are building a compliance platform. The fastest way to make sure it works is to use it on ourselves and watch what breaks.
Who we trust with your data.
Material changes notified to tenant admins at least 30 days in advance.
Found something? Tell us.
We run a coordinated disclosure program. Email security@opsnite.com with details of the issue. We acknowledge within one business day, triage within three, and aim to remediate critical findings within seven.
We do not currently run a paid bug bounty. We will publicly credit researchers who report meaningful issues (with permission).
Have a specific security question?
We answer in writing. No marketing speak, no dodging.