Security you can read, not a badge.
This page lists the controls OCNORA actually ships, how each one works, and where an evaluator can verify it. Where something is still on the roadmap, it says so.
Envelope encryption, one data key per secret.
A connection’s credentials are encrypted with a data key that exists only for that secret. The data key is wrapped by a key-management service, so the database never holds anything that decrypts on its own.
- secret ── AES-GCM ──▶ ciphertext (stored)
- data key ── KMS.wrap ──▶ wrapped key (stored beside it)
- KMS key ── never leaves the KMS
Rotate the KMS key and only wrapped keys are re-wrapped; ciphertexts stay put.
KMS: local or Google Cloud KMS
A local master key for development and small installs; Google Cloud KMS in production. The adapter is one interface.
On the roadmap: AWS KMS, Azure Key Vault, HashiCorp Vault
Adapters for these three are planned but not shipped. If your deployment requires one, tell us; it moves the schedule.
Decrypted only where used
A secret is unwrapped on the worker running the step, for the tenant that owns it, and dropped when the step finishes.
Personal data you can delete for real.
PII redaction in logs
Structured logs pass through a redactor before they are written. Emails, phone numbers and tokens are replaced, not truncated.
Windowed crypto-shredding
Personal data is written under a key window. Shredding the window’s key makes every copy unreadable at once, including in backups.
Tenant isolation on every query
The tenant filter is applied in the data layer. A route cannot forget it because it is not the route’s job.
Masked in previews and traces
Secrets and flagged fields show as masked values in node previews, run traces and the agent trace viewer.
Least privilege, enforced on every route.
28-permission RBAC
Owner, admin, editor and viewer roles composed from 28 permissions. The dashboard hides what the role cannot do; the API refuses it anyway.
Scoped API keys
Each key carries a permission scope and an expiry, and can be revoked immediately. Calls are attributed to the key in the audit log.
Brute-force limiter and rate limits
Repeated failed logins are slowed and then blocked; every route carries a rate limit.
httpOnly cookie sessions
Session tokens are never exposed to page scripts. Sign-out invalidates the session server-side.
Hardened by default, not by checklist.
Security headers
HSTS, frame and content-type protections and referrer policy on every response, including the embedded builder.
CSP with nonces and strict-dynamic
A per-request nonce and strict-dynamic mean an injected script does not run even if markup slips through.
HMAC-signed webhooks
Outbound webhooks carry an HMAC signature over the body; inbound webhook triggers can require one. Replayed or altered payloads are rejected.
Every mutation, every run step.
The audit log records who changed what, and what each run did: workflow version, node, connection used, output produced, human decisions waited on. It is exportable, so the evidence leaves with the auditor.
- 09:14:02workflow.publishuser:danawf_refund_router v14
- 09:14:03health.passsystemvalidate · preflight · dryrun
- 09:21:47run.steprun:7f3ahuman.prompt → approved by user:sam
- 09:21:48run.steprun:7f3astripe.refund · conn:stripe-prod
One image, compiled, signed.
Single container image
All process roles run from one image selected by an environment variable. One artifact to scan, one to approve.
Cython-compiled build
The engine ships compiled, not as readable source, which also removes a class of runtime patching.
Signed offline licence
Self-hosted and air-gapped deployments are activated with an Ed25519-signed licence file verified locally. No phone-home.
Found something? Tell us first.
Write to security@ocnora.com. We acknowledge within two business days, keep you informed while we fix it, and credit you if you want to be credited. Please give us reasonable time before publishing.
Controls, documented and available under NDA.
OCNORA does not hold a SOC 2 report today, and this page does not claim one. What we can give an evaluator is the documented control set above, the design notes behind each control, and a walkthrough with the engineers who built it, under NDA. If your procurement requires an attestation, tell us which one so we can plan for it.
Control → how OCNORA does it → where to verify.
| Control | How OCNORA does it | Where to verify |
|---|---|---|
| Secrets at rest | Envelope encryption: each secret has its own data key, wrapped by the KMS (local master key, or Google Cloud KMS in production). | Secrets and KMS design note |
| Secrets in use | Decrypted only on the worker executing the step, for the tenant that owns the connection; masked in previews, traces and logs. | Connections reference · Masking |
| Personal data | PII redaction in logs; windowed crypto-shredding so deleting a key window deletes the data everywhere. | Data lifecycle and crypto-shred note |
| Tenant isolation | Tenant scope applied in the data layer on every query, not per route. | Multi-tenancy design note |
| Authorization | 28 permissions composed into owner, admin, editor and viewer; checked on every API route. | RBAC permission matrix |
| API keys | Scoped to permissions, with expiry and one-click revocation; every call attributed in the audit log. | API keys reference |
| Authentication | httpOnly cookie sessions, brute-force limiter on login, rate limits on every route. | Authentication and rate-limit reference |
| Transport and app | Security headers on every response; CSP with per-request nonces and strict-dynamic; webhooks signed with HMAC. | HTTP hardening checklist |
| Audit | Every mutation and every run step recorded with actor, tenant, workflow, node and connection; exportable. | Audit log reference |
| Supply chain | One container image for all process roles, Cython-compiled build, offline Ed25519-signed licence with no phone-home. | Build and licence verification guide |
| Deployment | Docker Compose, Helm with AWS/Azure/GCP values, or air-gapped. Your cloud account, your KMS, your network. | Deployment guide |
Documents in the last column are shared under NDA as part of a security review.
Ask our team for the security whitepaper.
Sales replies within one business day with the whitepaper, the control documents under NDA, and a slot with an engineer.