Security you can read, not a badge.
This page lists the controls OCNORA actually ships, how each one works, how strong the evidence behind it is, and where an evaluator can verify it. Where something is still on the roadmap, it says so.
Control → implementation → evidence → where to verify.
| Control | Implementation | Evidence level | Where to verify |
|---|---|---|---|
| Secrets at rest | Connection secrets are envelope-encrypted with a data key wrapped by one of three key backends: a local master key, Google Cloud KMS or AWS KMS. | unverified checked 2026-09-27 | Secrets and KMS design note |
| Secrets in use | Decrypted only on the worker executing the step, for the tenant that owns the connection; masked in previews, traces and logs. | unverified checked 2026-09-28 | Connections reference · Masking |
| Personal data | PII redaction in logs; windowed crypto-shredding so deleting a key window makes the data unreadable everywhere. | unverified checked 2026-09-28 | Data lifecycle and crypto-shred note |
| Tenant isolation | Tenant scope applied in the data layer on every query, not per route. | unverified checked 2026-09-28 | Multi-tenancy design note |
| Authorization | Role-based permissions: owner, admin, editor and viewer roles are composed from individual permissions checked on every API route. | unverified checked 2026-09-27 | RBAC permission matrix |
| API keys | API keys are scoped to permissions, with expiry and immediate revocation; every call is attributed in the audit log. | unverified checked 2026-09-28 | API keys reference |
| Authentication | Dashboard users sign in with email and password, with multi-factor authentication, or through OIDC or SAML 2.0 (SP-initiated) single sign-on where the installation has an identity provider configured; SCIM 2.0 provisions users and groups from that identity provider. Embedded users arrive through JIT SSO. | implemented checked 2026-10-20 | Authentication and SSO reference |
| Provisioning | SCIM 2.0 provisioning: the identity provider creates, updates, suspends and removes dashboard users and groups through the /scim/v2 endpoints with a SCIM token issued for the company; suspending or removing a user ends their sessions and API keys. | implemented checked 2026-10-20 | SCIM 2.0 reference |
| Sessions and rate limits | httpOnly cookie sessions, a brute-force limiter on login and rate limits on every route. | unverified checked 2026-09-28 | Authentication and rate-limit reference |
| Transport and app | Security headers on every response; CSP with per-request nonces and strict-dynamic; webhooks signed with HMAC. | unverified checked 2026-09-28 | HTTP hardening checklist |
| Audit | Each run keeps its steps with their input, output, status and the connection used, and the audit log records who changed which workflow, connection or setting and when. The audit log is exportable. | unverified checked 2026-09-28 | Audit log reference |
| Supply chain | One container image for all process roles, a Cython-compiled build and an offline Ed25519-signed licence with no phone-home. | unverified checked 2026-09-28 | Build and licence verification guide |
| Deployment | OCNORA runs on OCNORA Cloud, on the customer’s own cloud from the Docker Compose file or the Helm chart in the backend repository, or embedded in the customer’s product. The Helm chart runs each process role as its own deployment, including Workflow Health, Auto Fix and the task orchestrator. | unverified checked 2026-09-28 | Deployment guide |
- measured :
- counted from a published artefact.
- implemented :
- shipped in the product, with the code that ships it named.
- unverified :
- recorded by hand from the product and not yet re-checked against its source. Most controls below are at this level today; the documents in the last column are how an evaluator checks it.
Documents in the last column are shared under NDA as part of a security review.
Envelope encryption, one data key per secret.
A connection’s credentials are encrypted with a data key that exists only for that secret. The data key is wrapped by a key-management service, so the database never holds anything that decrypts on its own.
- secret ── AES-GCM ──▶ ciphertext (stored)
- data key ── KMS.wrap ──▶ wrapped key (stored beside it)
- KMS key ── never leaves the KMS
Rotate the KMS key and only wrapped keys are re-wrapped; ciphertexts stay put.
KMS: local, Google Cloud KMS or AWS KMS
A local master key for development and small installs; Google Cloud KMS or AWS KMS in production. The adapter is one interface.
Not offered: Azure Key Vault, HashiCorp Vault
Adapters for these two are not shipped. If your deployment requires one, tell us; it moves the schedule.
Decrypted only where used
A secret is unwrapped on the worker running the step, for the tenant that owns it, and dropped when the step finishes.
Personal data you can delete for real.
PII redaction in logs
Structured logs pass through a redactor before they are written. Emails, phone numbers and tokens are replaced, not truncated.
Windowed crypto-shredding
Personal data is written under a key window. Shredding the window’s key makes every copy unreadable at once, including in backups.
Tenant isolation on every query
The tenant filter is applied in the data layer. A route cannot forget it because it is not the route’s job.
Masked in previews and traces
Secrets and flagged fields show as masked values in node previews, run traces and the agent trace viewer.
Least privilege, enforced on every route.
Role-based permissions
Owner, admin, editor and viewer roles composed from individual permissions. The dashboard hides what the role cannot do; the API refuses it anyway.
Scoped API keys
Each key carries a permission scope and an expiry, and can be revoked immediately. Calls are attributed to the key in the audit log.
Brute-force limiter and rate limits
Repeated failed logins are slowed and then blocked; every route carries a rate limit.
httpOnly cookie sessions
Session tokens are never exposed to page scripts. Sign-out invalidates the session server-side.
MFA, single sign-on and SCIM
Dashboard users sign in with email and password, with multi-factor authentication, or through OIDC or SAML 2.0 (SP-initiated) single sign-on where the installation has an identity provider configured; SCIM 2.0 provisions users and groups from that identity provider. Embedded users arrive through JIT SSO.
Hardened by default, not by checklist.
Security headers
HSTS, frame and content-type protections and referrer policy on every response, including the embedded builder.
CSP with nonces and strict-dynamic
A per-request nonce and strict-dynamic mean an injected script does not run even if markup slips through.
HMAC-signed webhooks
Outbound webhooks carry an HMAC signature over the body; inbound webhook triggers can require one. Replayed or altered payloads are rejected.
Every mutation, every run step.
The audit log records who changed what, and what each run did: workflow version, node, connection used, output produced, human decisions waited on. It is exportable, so the evidence leaves with the auditor.
- 09:14:02workflow.publishuser:danawf_refund_router v14
- 09:14:03health.passsystemvalidate · preflight · dryrun
- 09:21:47run.steprun:7f3ahuman.prompt → approved by user:sam
- 09:21:48run.steprun:7f3astripe.refund · conn:stripe-prod
One image, compiled, signed.
Single container image
All process roles run from one image selected by an environment variable. One artifact to scan, one to approve.
Cython-compiled build
The engine ships compiled, not as readable source, which also removes a class of runtime patching.
Signed offline licence
Self-hosted and air-gapped deployments are activated with an Ed25519-signed licence file verified locally. No phone-home.
Your data stays where you deploy it.
Self-hosted and embedded installations keep workflow data, run history and secrets in the customer’s own cloud account, region and database; the licence is verified offline and nothing is sent to OCNORA. On OCNORA Cloud, OCNORA operates that infrastructure; its processing region is not published yet and is given on request to the security contact.
No fixed OCNORA Cloud region is published. Model vendors and connected apps receive what a workflow sends them, in their own regions, under the customer’s accounts with those vendors.
Claim dataHandling · unverified · checked 2026-09-28
Who else touches the data.
On a self-hosted or embedded installation OCNORA is not a processor of the customer’s data. For OCNORA Cloud, the subprocessor list is not published on the site; ask the security contact for it.
No subprocessor is named here. Model vendors and apps a workflow calls are chosen and contracted by the customer and are not OCNORA subprocessors.
Claim subprocessors · unverified · checked 2026-09-28
Found something? Tell us first.
Write to security@kxntech.com with the affected URL or component, the steps to reproduce and the impact you saw.
Report a suspected vulnerability to the security contact first. OCNORA acknowledges within two business days, keeps the reporter informed while it is fixed, credits the reporter if they want it, and does not pursue good-faith reporters. Please give us reasonable time to fix it before publishing.
An acknowledgement, not a fix time: no remediation deadline is promised, and no reward. Testing that degrades service for other users, touches data that is not yours or uses social engineering is out of scope. A mailbox, not an on-call line. security.txt names no encryption key for it; ask for one before sending details you need encrypted.
Machine-readable contact: /.well-known/security.txt
Claim disclosurePolicy · unverified · checked 2026-09-28
Controls, documented and available under NDA.
OCNORA does not hold a SOC 2 report today, and this page does not claim one. What we can give an evaluator is the documented control set above, the design notes behind each control, and a walkthrough with the engineers who built it, under NDA. If your procurement requires an attestation, tell us which one so we can plan for it.
Ask our team for the security whitepaper.
Sales replies within one business day with the whitepaper, the control documents under NDA, and a slot with an engineer.