Trust & Security
How Offload Security protects the platform itself — the questions security reviewers and procurement teams ask, answered in one place. For deeper due-diligence material (detailed architecture, data-flow diagrams, assessment reports), contact us for the NDA trust pack.
Tenant isolation
Every record on the platform is scoped to your team. All queries filter on that scope server-side — API keys and user sessions both resolve to a team before any data is read. Role-based access control (Roles, Teams & API Keys) governs what members of a team can see and do, and an audit trail records every authenticated request with actor, team, action and outcome, sensitive fields redacted, for 365 days by default.
Credentials & secrets handling
Cloud credentials, registry credentials, integration tokens and Knowledge Base provider keys you store on the platform are encrypted at rest with authenticated symmetric encryption (Fernet: AES-128-CBC with HMAC-SHA256) under keys that live in the deployment's secret store or environment (CLOUD_ENCRYPTION_KEY for cloud credentials, INTEGRATION_ENCRYPTION_KEY for integration credentials) — generated by the setup wizard, never in application code. Secrets are decrypted only at the moment of use (when a scan authenticates to your cloud account, when an alert is posted to your webhook) and are never returned by the API once saved. User passwords are hashed (PBKDF2-SHA256, 600,000 iterations, per-user salt); session tokens, API keys and invitation tokens are stored only as SHA-256 hashes.
For scanning, the platform asks only for read-only roles wherever the provider supports it — see cloud permissions for the exact policies per cloud.
API security
- Authentication — 24-hour user sessions (at most five per user, revocable by the platform administrator), optional TOTP MFA with deployment-wide enforcement, OIDC single sign-on, and scoped API keys for automation with expiry, IP allowlists, per-key rate limits and rotation. See Platform Security and API & Automation.
- Rate limiting — the public API enforces per-client rate limits and returns standard
X-RateLimit-*headers with429responses when exceeded. - Signed webhooks — outbound webhook deliveries are signed with HMAC-SHA256 so your receivers can verify authenticity, with retries and a delivery log. Webhook destinations are validated to block private, internal, and cloud-metadata addresses.
How AI features handle your data
The platform's AI features (summaries, remediation suggestions, questionnaire auto-fill, the assistant) are designed so that AI is a consumer of your data under the same controls as everything else:
- Scoped retrieval. AI answers are generated from data your team already has access to — the same tenant scoping applies to AI context as to API queries.
- Configurable model providers. AI calls route through a central provider layer to leading LLM APIs. On-premises and enterprise deployments can configure their own provider keys, so inference happens under your own agreements.
- A cache that never crosses tenants. Frequently asked generic platform questions are answered from a curated knowledge cache without any model call. Only tenant-neutral content is ever cached — answers derived from your data are not stored in the shared cache.
- No training on your data. Your data is sent to model providers only to serve the specific request, under API terms that do not use it for model training.
- AI is advisory. Suggestions (remediation guidance, auto-fill drafts) are drafts for human review — they never change your configuration or accept a risk on their own.
Deployment options & data residency
- SaaS — the managed platform.
- On-premises / private deployment — the full platform inside your own environment, where scan data, findings, evidence, and reports never leave your network. This is the deployment regulated customers (banks, entities with data-localization obligations) typically choose. See On-Premises and India regulatory readiness.
Data retention & deletion
Retention is enforced platform-wide: scan results age out on schedules (SCAN_RETENTION_DAYS 90, cloud and container scans 180 by default), generated reports after 180 days (REPORT_RETENTION_DAYS), audit-trail events after 365 (AUDIT_TRAIL_RETENTION_DAYS), and regulated records where the regulation requires specific periods (for example, DPDP audit records), and deleting a team or account cascades through the platform's data stores rather than orphaning records. On request, customer data is deleted at contract end.
Secure development
The platform is built with the same controls it sells: static analysis, dependency and secret scanning, container image scanning, and CI/CD release gates run on the platform's own codebase, and findings are triaged through the same workflow customers use.
Responsible disclosure
If you believe you've found a security vulnerability in Offload Security, email security@offloadsecurity.com. We acknowledge reports promptly, keep you informed through remediation, and credit reporters who wish to be named. Please don't test against other customers' data — on request we can provide a test tenant.
Formal third-party certifications for the platform are in progress. Ask us for the current status and available attestation documents as part of your vendor review.