SECURITY

Enterprise-Grade Security, Built In

Your data is protected by the same standards used by Fortune 500 companies.

Multi-Tenant Isolation

Every organization runs in a completely isolated environment. Separate databases, separate encryption keys, separate runtime contexts. No data sharing, no cross-tenant access, ever.

Zero-Trust Authentication

Every request validates user identity, tenant scope, role permissions, and group membership. Short-lived tokens, automatic rotation, and complete session management.

AES-256 Encryption

All data encrypted at rest and in transit. TLS 1.3 for communications, AES-256 for storage. Credentials managed through AWS Secrets Manager — never stored in code.

Tamper-Evident Audit Trail

Every action logged with SHA-256 hash chains. Each record cryptographically linked to the previous. Immutable, verifiable, and compliance-ready.

Role-Based Access Control

Granular permissions with roles controlling what users can do and licenses controlling which workspaces they can access. Admin-enforced MFA policies across the organization.

Compliance Ready

SOC 2 Type II aligned controls. GDPR data handling with right-to-erasure support. Automated compliance evidence collection and reporting through the GRC dashboard.

[ Architecture ]

Security at Every Layer

Operon's security model is layered from edge to data. Each layer enforces its own security controls, so even if one layer is compromised, the others prevent unauthorized access. Tenant isolation is enforced at every level — not just the application layer.

Edge protection with WAF and rate limiting
Authentication validates every request
Authorization enforces role + workspace access
Runtime sandboxes agent execution
Data layer encrypts everything at rest

SOC 2 Type II

Aligned controls

GDPR

Data privacy

HIPAA Eligible

Architecture supports healthcare compliance

ISO 27001

Information security

[ Security FAQ ]

Common Security Questions

Each tenant gets fully isolated database schemas, encryption keys, and runtime contexts. Cross-tenant access is architecturally impossible — tenant ID is validated at every layer.

Yes, on Enterprise plans. We support SAML 2.0 and OIDC for enterprise single sign-on with Google Workspace, Azure AD, Okta, and other identity providers.

All data is stored in AWS us-east-1 region. RDS PostgreSQL with multi-AZ deployment for high availability. All backups encrypted. Enterprise customers can request custom regions.

Every action in Operon generates an immutable audit record with SHA-256 hash chains. Each record includes who, what, when, and where. Audit logs can be exported for compliance reporting.

Operon is designed with SOC 2 Type II aligned controls from the ground up. Formal certification is in progress. Contact us for our current security documentation.