/ trust

Security & compliance

Honest is better than aspirational. Below is what is live in production today vs. what is planned. Anything not on this page does not exist yet — please push back if a salesperson tells you otherwise.

• AES-256-GCM at-rest secret encryption

  live

  All SSO, storage, and KMS credentials are envelope-encrypted with a server-held master key before persistence.

  Details →

• TLS 1.2+ in transit

  live

  Edge proxy enforces TLS 1.2 minimum; HSTS preload on oxp.sh.

• WASM sandbox for extension code

  live

  Untrusted extension logic runs inside a Wasmtime component with no host syscalls.

  Details →

• Sigstore-signed releases

  live

  Every published bundle is signed; publishers can bring their own KMS key.

  Details →

• GDPR Data Processing Agreement

  live

  Standard DPA available to Pro/Teams/Enterprise customers on request via sales@oxp.sh.

• Custom MSA + DPIA support

  live

  Enterprise customers receive a tailored MSA, DPIA support, and named DPO contact.

• Sub-processor disclosure list

  live

  Neon (database), Cloudflare (edge), Paddle (billing). Updates posted with 30-day notice.

  Details →

• Audit log retention

  live

  30 days on Pro, 365 on Teams, unbounded on Enterprise.

• Bring-your-own object storage

  live

  S3 / R2 / MinIO supported with mandatory smoke test before activation.

  Details →

• Customer-managed signing keys

  live

  AWS KMS today; GCP KMS, Azure Key Vault, and HashiCorp Vault next.

• SOC 2 Type II

  planned

  Audit period scheduled. We don't claim certification we don't have. Contact sales for the current control narrative.