In progress
ISO/IEC 27001
Working toward certification of our information security management system.
Security
Security you can review.
Controls you can verify.
Understand how your applications connect, how access is scoped, and what protects your chosen deployment. Give your team a clear path from security review to production.
Designed for review
Know the boundary.
Review the controls for your deployment.
01Identity & access
02Deployment isolation
03Evidence & policies
Security & compliance
Security programs.
Current status.
ISO 27001 certification and SOC 2 Type II attestation are in progress. Neither assessment has been completed.
In progress
SOC 2 Type II
Working toward an independent assessment of controls over a defined period.
Contact us for progress updates and the planned assessment scope.
Request security informationCompliance roadmap
Planned
compliance work.
Planned programs for privacy, healthcare and payment-data workloads. Follow what’s coming next.
Data privacy
GDPR readiness
Supporting European data protection requirements, processing agreements and data-subject requests.
Healthcare
HIPAA readiness
Preparing safeguards and business associate agreements for workloads that handle protected health information.
Payment data
PCI DSS readiness
Preparing the controls and assessment scope for environments that handle payment-card data.
Privacy management
ISO/IEC 27701
Building a privacy information management program with defined responsibilities and review processes.
These programs are planned, not current compliance claims. Scope and availability will be shared as each is ready.
Discuss your requirementsIdentity & access
Make access intentional.
Connect with the right credential, apply the appropriate controls, and keep changes visible to your team.
Credentials with a purpose
Use separate instance tokens for your applications. Keep organization management keys and database-user identities distinct, and replace or revoke credentials as your team changes.
Credential lifecycleAccess close to the data
Apply table grants, row policies and column masking on supported database-user read paths. Verify both allowed and denied operations using the identity your application actually sends.
Authentication & accessA record of permission changes
Inspect the engine’s hash-linked authorization history for user, role, grant and policy changes. Use the available verification and export controls in the connected console.
Review access historyApplication to database
Keep the identity clear
at every step.
- 01Your application
Authenticate users and enforce your application’s access rules.
- 02Your server
Keep secrets server-side and pass the intended database identity.
- 03OriginChainDB
Authenticate the request and apply the configured, supported query controls.
Console membership and database-user permissions are separate. An administrative bearer does not demonstrate the access of a restricted database user.
Infrastructure & recovery
Choose the boundary
your workload needs.
Shared hosting and dedicated resources have different isolation and recovery properties. Match the configuration to your requirements.
Shared configurations
Separate database access.
Free and shared configurations use shared infrastructure. Each database has its own hostname and bearer credential.
- Public database endpoints use HTTPS.
- Database credentials are scoped to the instance and tenant.
- Shared resources do not provide dedicated compute isolation.
Dedicated configurations
Compute for one customer.
Dedicated virtual machines and database storage serve one customer, with region and recovery choices reviewed for the deployment.
- Encrypted nightly snapshots are included.
- Optional standby replication is asynchronous.
- Confirm recovery, retention and network requirements before launch.
Private connectivity and recovery capabilities depend on your configuration. Review the applied network settings and documented recovery limitations.
Read the architectureFor your security review
The right information.
The right conversation.
Share your questionnaire, deployment requirements and evidence needs. We’ll help your team review the controls and documents relevant to your application.
Talk to our team Useful details to bring
- Your intended region and configuration
- Access, network and retention requirements
- Required assessment documents and review timeline
Responsible disclosure
Found a security issue?
Let’s address it.
Send a minimal reproduction, the affected version and your assessment of the impact. Leave credentials and customer data out of the report.
security@originchaindb.comNeed to share sensitive details?
Request a PGP key by email before sending an encrypted disclosure.
Keep the report focused.
Include the relevant endpoint, instance details, timestamps and request IDs where available. Never include tokens or private keys.
Choose how you’re credited.
Reporters are credited in release notes unless they prefer to remain anonymous.
Build with OriginChainDB