Skip to main content
OK-GRC

Security and trust

Uncompromising security for your compliance data

Your risk registers, evidence and incidents are sensitive. Here is concretely how we protect them. Items marked “To be verified” will be confirmed before the commercial launch.

  • Hosting in the European Union

    • Application, database and files hosted with IONOS in the European Union
    • Exact data centre locationTo be verified
    • Encrypted backups, tested regularlyTo be verified
    • No customer data stored outside the EU by OK-GRC

  • Encryption

    • TLS on every connection, HSTS enabled
    • Files encrypted at rest (object storage, AES-256)To be verified
    • Customer secrets (AI API keys) sealed with AES-256-GCM
    • Passwords hashed with Argon2id

  • Isolation between customers

    • Every query is restricted to your organisation by the database itself (forced PostgreSQL Row Level Security)
    • Links between records constrained per organisation: no record can point to another customer
    • Separate database roles for the application and for administration
    • Unguessable identifiers and no enumeration of organisations

  • Authentication and access

    • Two-factor authentication (TOTP), passkeys, Google and Microsoft
    • SAML / OIDC SSO on your verified domain (Enterprise plan)
    • Mandatory MFA available for the whole organisation
    • Support access only with your authorisation, time-boxed and traced

  • Traceability

    • Tamper-proof activity log: no change or deletion possible, not even by us
    • Consultant and support actions identified as such
    • History of every document, risk, control and piece of evidence
    • Exports for your auditor or your SIEM

  • Controlled artificial intelligence

    • You choose the provider: Claude (Anthropic) or a sovereign model hosted by OK-GRC
    • AI can be turned off for the whole organisation
    • Optional masking of personal data before sending
    • Your data is not used to train the models (provider terms)To be verified

  • Files and evidence

    • Antivirus scan before anything is made available
    • Allow-list of formats and check of the actual file content
    • Downloads through short-lived signed links
    • SHA-256 fingerprint of every version

  • Application security

    • Developed against OWASP ASVS level 2
    • Strict security headers (CSP, HSTS, clickjacking protection)
    • Rate limiting of sign-ins and forms
    • Monitored dependencies and continuous security scansTo be verified

GDPR: OK-GRC as processor of your data

For the data you put into the platform, ESERENIT acts as a processor under Article 28 of the GDPR. A data processing agreement sets out our commitments and the list of our sub-processors is public.

Read the data processing agreementSee the sub-processors

Reversibility

Your data belongs to you. Export your frameworks, Statements of Applicability, registers, documents and evidence at any time in open formats (XLSX, CSV, PDF, original files).

Report a vulnerability

Think you found a vulnerability? Write to the security address below, describing the affected page, the steps to reproduce and the impact observed. We acknowledge within 3 business days and do not pursue good-faith research.

Security contact addressTo complete

What about our own certification?

We apply to OK-GRC the frameworks we support. ISO 27001 certification of the platform is a goal; we will publish the certificate and its scope here as soon as it is obtained.

Contact

Ready to simplify your compliance?

Create your workspace in minutes. The assistant suggests the frameworks and priorities that fit your company.

Start the free trialBook a demo

14-day trial with every Pro feature · Nothing charged before the trial ends · No commitment