Security at Oppex
How Oppex protects your incident data, who can access it, and what the AI is allowed to do.
Oppex is SOC 2 compliant and follows GDPR. Customer data is encrypted in transit and at rest on AWS, every organization and workspace is kept separate, every configuration change is written to an audit log that cannot be edited, and Oppex AI only receives the data an incident needs.
Compliance
- SOC 2. Oppex is SOC 2 compliant. Contact the Oppex team for compliance documentation.
- GDPR. Oppex follows GDPR for the personal data it processes, such as responders' names, email addresses and phone numbers.
Where your data lives
- Oppex runs in AWS data centers in the United States, and can be hosted in other regions to meet your requirements.
- The database is encrypted at rest with a dedicated key, runs across multiple availability zones, is not reachable from the internet, and is backed up automatically, with backups kept for 7 days.
- Every record carries its organization and workspace, and each request is scoped to the caller's own organization and workspace.
- On the Enterprise plan, Oppex can run in your own cloud account, with self-hosted LLMs, so incident data stays in your environment.
Encryption
- In transit: every connection to Oppex uses TLS 1.2 or 1.3.
- At rest: the database is encrypted with a dedicated AWS KMS key.
- Credentials you give Oppex, such as an SSO client secret, are encrypted again by Oppex itself with AES-256-GCM before they are stored. Infrastructure secrets are kept in a centralized secrets store.
Sign-in and access control
- Single sign-on with Google, Slack and JumpCloud, using OAuth 2.0 and OpenID Connect with PKCE, as well as email and password. Each organization connects JumpCloud with its own client credentials.
- Five roles: Account Owner, Account Admin, Workspace Admin, Service Admin and Responder. Owners and Account Admins cover the whole organization; the other roles apply to one workspace or service. Nobody can grant a role higher than their own.
- API keys belong to one workspace and act only inside it. Lower roles see only the keys they created.
Audit log
Every configuration change, such as to services, escalation policies, schedules, teams, users, integrations and routing rules, is recorded with who made it, which workspace it was in, what changed field by field, when, whether it succeeded, and whether it came from the web app, an API key, Oppex Nova or Oppex support. The log is append-only: entries cannot be edited or deleted. Owners, Account Admins and Workspace Admins can review it, one workspace at a time (audit log documentation).
How Oppex AI handles your data
- Oppex sends only incident-relevant data, such as the incident details and the related log lines, to the AI models it uses.
- Your data is never used to train shared models.
- Actions you mark as destructive wait for a workspace administrator to approve or reject them before they run, and each decision is recorded with the approver's name.
Integrations
- Alerts from monitoring tools are accepted only with your API key and the service's integration key.
- Callbacks from the phone and SMS provider, and events from GitHub, are verified by their signatures before Oppex acts on them.
Reliability
Live uptime and past incidents for the Oppex platform are published at status.oppex.ai. Pages to your on-call engineers are recorded attempt by attempt, text messages and WhatsApp messages fall back to a second delivery provider, and escalation keeps going when a page fails (how paging delivery works).
Frequently asked questions
Is Oppex SOC 2 compliant?
Yes. Oppex is SOC 2 compliant and follows GDPR for the personal data it processes. Contact the Oppex team for compliance documentation.
Where is Oppex customer data stored?
Oppex runs in AWS data centers in the United States, and can be hosted in other regions to meet your requirements. Its database is encrypted at rest, runs across multiple availability zones, is not reachable from the internet, and is backed up automatically. On the Enterprise plan, Oppex can run in your own cloud account instead.
Is my data used to train AI models?
No. Oppex sends only incident-relevant data, such as the incident details and the related log lines, to the AI models it uses, and that data is never used to train shared models. On the Enterprise plan you can run Oppex with self-hosted LLMs in your own cloud.
Which single sign-on providers does Oppex support?
Oppex supports sign-in with Google, Slack and JumpCloud, using OAuth 2.0 and OpenID Connect with PKCE, as well as email and password. Each organization connects JumpCloud with its own client credentials.
Does Oppex keep an audit log?
Yes. Every configuration change, such as to services, escalation policies, schedules, users, integrations and routing, is recorded with who made it, what changed, when, and whether it succeeded. The audit log cannot be edited or deleted, and workspace administrators can review it in Oppex.
Can Oppex AI change my systems without approval?
Not for actions you mark as destructive. When you connect a tool to Oppex you declare what each action can do, and a destructive step waits for a workspace administrator to approve or reject it before it runs. Each decision is recorded with the approver's name.
Have a security question we didn't answer?
Talk to the Oppex team about your security review.