Row-Level Security
Every database table containing tenant operational data is protected by native PostgreSQL RLS policies. Queries are filtered at the connection level by your enterprise scope, eliminating any risk of cross-tenant exposure.
Enterprise compliance standards
OptimaOS Privacy & Data Protection Policy
Detailed commitment to multi-tenancy logical isolation, cryptographic keys versioning, OCI vault storage security, and compliance auditing.
Compliance verified
Logical isolation RLS
Envelope keys
Active rotation
01 / Separation
Client Data Isolation & Multi-Tenancy
OptimaOS runs on a multi-tenant database using strict logical boundary partitioning to separate clients.
Database Logical Scope
No shared memory or query contexts span across different clients. The query builder guarantees that every connection executes in a tenant-specific execution environment.
02 / Encryption
Cryptographic Protection & Encryption
We deploy standard encryption frameworks at every layer of the infrastructure.
OCI KMS Vault
Host volumes and databases run on Oracle Cloud Infrastructure (OCI) encrypted storage. Volume encryption keys are managed through HSM-backed OCI KMS Vaults, safeguarding storage at rest.
Envelope Encryption
Sensitive client profiles, single sign-on secrets, and visitor metadata are encrypted using AES-256-GCM in the application layer before being saved to storage.
Location Isolation
High-security facilities can provision independent, wrapped keys. Data collected within these locations is cryptographically isolated from the parent enterprise key.
Transit Protection
All public endpoints enforce TLS 1.3 transit encryption (HTTPS/WSS) with Strict Transport Security (HSTS) and SameSite session cookie protection.
03 / Auditing
Vetted Open-Source Core & Lifecycle
OptimaOS is built on fully transparent, open-source foundations.
Open-Source Trust
Built on standard public core stacks (Linux, Node.js, and PostgreSQL). Running on open source ensures that our security mechanisms are peer-reviewed, free of hidden backdoors, and easily auditable by your security teams.
Key Rotation
Enterprise administrators can rotate encryption keys in-place through our administration console. Rotating a key generates a new version, deactivates older versions for write operations, and dynamically migrates historical database rows with zero downtime.