Security

Enterprise-Grade Security

Your RAG pipeline data contains sensitive information. We designed Obsyn from the ground up to keep it secure — your data never leaves your infrastructure.

Data Never Leaves Your VPC

Obsyn operates entirely within your infrastructure. Our agent runs as a sidecar container in your cluster — no data egress, no external API calls, no telemetry sent to us.

âœ“Self-hosted agent in your Kubernetes cluster or VM
âœ“No outbound internet access required
âœ“Air-gapped deployment supported
âœ“Data stays in your AWS/GCP/Azure region

End-to-End Encryption

All data encrypted at rest (AES-256) and in transit (TLS 1.3). Embedding vectors, query logs, and quality metrics are encrypted with customer-managed keys.

âœ“AES-256 encryption at rest with customer-managed KMS keys
âœ“TLS 1.3 for all data in transit
âœ“Key rotation automation with zero-downtime
âœ“Hardware security module (HSM) support

SSO & Access Control

SAML 2.0 and OIDC integration for authentication. Role-based access control (RBAC) with granular permissions for viewing pipelines, metrics, and configurations.

âœ“SAML 2.0 / OIDC integration (Okta, Azure AD, Google Workspace)
âœ“RBAC with custom roles and permissions
âœ“API key management with scoped access
âœ“Audit logging for all access events

SOC 2 Type II Certified

Annual SOC 2 Type II audits with full report available under NDA. We maintain compliance controls for security, availability, and confidentiality trust principles.

âœ“Annual third-party SOC 2 Type II audit
âœ“Continuous compliance monitoring
âœ“Full report available under NDA
âœ“Automated evidence collection for auditors

Audit Logs & Compliance

Complete audit trail of all system access, configuration changes, and data queries. Exportable logs for compliance frameworks including HIPAA, GDPR, and CCPA.

âœ“Immutable audit logs for all user actions
âœ“Configuration change tracking with diff view
âœ“Data access logging with query attribution
âœ“Compliance report generation (HIPAA, GDPR, CCPA)

Data Retention & Privacy

Configurable data retention policies with automatic purging. PII detection and masking for query logs. GDPR-compliant data deletion workflows.

âœ“Configurable retention periods (1 day to indefinite)
âœ“Automatic data purging with zero-touch compliance
âœ“PII detection and automatic masking in logs
âœ“GDPR right-to-deletion workflow automation

Vulnerability Management

Continuous dependency scanning, container image scanning, and penetration testing. Bug bounty program through HackerOne for responsible disclosure.

âœ“Automated dependency scanning (Snyk, Dependabot)
âœ“Container image scanning before deployment
âœ“Quarterly third-party penetration testing
âœ“HackerOne bug bounty program

Incident Response

Documented incident response plan with defined SLAs. 24/7 on-call security team with 15-minute response time for critical vulnerabilities.

âœ“24/7 on-call security response team
âœ“15-minute response SLA for critical vulnerabilities
âœ“Public incident status page
âœ“Post-incident review and root cause analysis

Compliance & Certifications

SOC 2 Type II

Annual audit with full report

GDPR Compliant

Data protection by design

HIPAA Ready

BAA available for healthcare

Security Contact

For security-related inquiries, vulnerability reports, or to request our SOC 2 report, contact our security team directly.

Email: security@obsyn.dev

HackerOne: hackerone.com/obsyn