Security
Security at OpenSecura
OpenAIDR watches what AI agents do on your computers, so we hold ourselves to the controls we ask of our customers. This page summarizes how OpenSecura protects the hosted service and the data it handles.
OpenSecura runs its information security program against the SOC 2 framework. A SOC 2 Type II audit by an independent firm is planned for 2027; the report will be available to customers under NDA once it is issued. Until then, the statements below describe the controls we operate today, not audited results.
Organizational security
- Information security program
- Our information security program follows the criteria of the SOC 2 framework, the information security auditing standard of the American Institute of Certified Public Accountants. Its policies cover information security, access control, change management, secure development, incident response, business continuity, data retention and vendor management, and are communicated to the whole team.
- Roles and responsibilities
- A named security lead is accountable for the program and for the protection of customer data, with a designated alternate for incident response. Security responsibilities are documented, and every team member is required to review and accept our security policies.
- Code of conduct and confidentiality
- Every team member accepts our Code of Conduct, which includes confidentiality obligations for customer data and company information.
- Security awareness training
- Team members complete security awareness training that covers industry standard practices such as phishing, password handling and the safe use of AI tools.
- Managed devices
- Team members work on company-owned computers with disk encryption, screen lock and anti-malware protection, and the security state of each device is checked continuously.
Cloud security
- Cloud infrastructure
- The hosted OpenAIDR service runs on Google Cloud, which operates a robust security program with multiple certifications. See Google Cloud compliance for the provider's own controls.
- Data hosting
- Customer data is stored in Google Cloud databases and storage in the United States (us-central1).
- Tenant isolation
- Each hosted customer runs in a dedicated tenant cell with its own database. Tenants do not share application processes or data stores.
- Encryption at rest
- All databases, backups and object storage are encrypted at rest.
- Encryption in transit
- The desktop app, the sensor, the dashboard and our APIs communicate over TLS only.
- AI processing
- Analysis that uses external model providers goes through our gateway, which removes credentials and sensitive values before anything leaves our environment.
- Vulnerability management
- Automated dependency and code scanning runs on changes to our production branches, and findings are triaged and fixed by severity.
- Logging and monitoring
- Administrative and security-relevant changes to our cloud environment are logged, and alerts for those changes and for failures affecting users reach the team.
- Backups and recovery
- Databases are backed up daily with point-in-time recovery, and tenant data is snapshotted so that a hardware failure does not cause data loss. Monitoring alerts the team to any failure that affects users.
- Incident response
- We have a process for handling information security events that includes escalation, rapid mitigation and communication with affected customers.
Access security
- Permissions and authentication
- Access to cloud infrastructure and other sensitive tools is limited to the team members who need it for their role. Single sign-on, two-factor authentication and strong password policies protect access to our cloud, code hosting and workspace services.
- Least privilege
- We follow the principle of least privilege for identity and access management, and administrative access to production is granted per task and logged.
- Access reviews
- We review who has access to sensitive systems at least quarterly and remove access that is no longer needed.
- Passwords
- Minimum password requirements apply to every account, and the team uses a company password manager for shared and service credentials.
Vendor and risk management
- Risk assessments
- We assess risks to the service and to customer data at least annually, including fraud considerations, and track the resulting actions.
- Vendor risk management
- New vendors that process customer data are reviewed for their security practices before they are authorized.
Product security
- Open source
- The OpenAIDR sensor and backend are open source, so anyone can inspect what runs on their machines and how evidence is collected.
- Independent testing
- Independent penetration testing of the hosted service is planned ahead of the SOC 2 audit, and its results will feed our remediation backlog.
Report a security issue
If you have questions or concerns about our security, or want to report a potential security issue in OpenAIDR or the hosted service, write to security@opensecura.ai. We read every report and reply to each one. Please only test against systems you are authorized to use. For anything else, see Contact.