Security

Last updated: October 2026

OptimusHub is designed from the ground up for high-security, regulated, and air-gapped environments - including sovereign infrastructure, defense networks, and organizations where public cloud access is not permitted or not desired. Security is a first-class platform concern at every layer of the architecture.

RBAC Air-Gap Native Self-Hosted Zero External Telemetry Audit Trail Fernet-Encrypted Vault Built-In PKI / CA TLS 1.2+

1. Deployment Architecture

OptimusHub runs entirely within your infrastructure. The platform has no mandatory external dependencies - it is designed to operate with zero internet egress in fully air-gapped environments.

All data, credentials, secrets, and audit records remain within your controlled environment at all times
No telemetry, diagnostic information, or usage data is transmitted to OptimusHub or any third party; licensing does not require the installation to connect to the vendor
Releases are delivered as tarballs that can be transferred via portable media into air-gapped environments
The control plane API is not externally reachable; access is scoped to your internal network by design

2. Control Alignment

Designed to support organizations preparing for SOC 2 Type II audit controls (specifically CC6, CC7, and C1). OptimusHub itself holds no SOC 2 or ISO 27001 certification. The following controls are native to the platform:

CC6 - Logical Access RBAC with least-privilege defaults. Namespace-level Kubernetes access grants. Authentication and MFA are handled by your enterprise IdP. All access explicitly granted, never inherited.

CC7 - System Operations Audit trail for every platform action. Alert rules with SMTP delivery. Deployment log streaming and SSH session audit.

CC8 - Change Management All deployments, Helm releases, and configuration changes are logged with actor identity, timestamp, and result. Changes are traceable and attributable.

CC9 - Risk Mitigation Encrypted secrets vault. Internal PKI/CA for certificate lifecycle. No single-point secrets exposure - credentials never appear in logs or API responses after creation.

A1 - Availability DR plans with priority-ordered power-on, affinity groups, and database backup policies with cron scheduling.

C1 - Confidentiality Fernet-encrypted secrets vault. TLS 1.2+ in transit. Volume-level encryption configured in your environment. Scoped credential access with expiry. No data leaves the customer's environment.

3. Identity and Access Control

Role-Based Access Control (RBAC) Four built-in system roles (admin, devops, developer, dba; these cannot be modified or deleted) plus custom roles. Namespace-level Kubernetes access grants per user and group.

Multi-Factor Authentication (MFA) Authentication and MFA are delegated entirely to your external enterprise Identity Provider (IdP) via standard OIDC, SAML 2.0, or LDAP. OptimusHub enforces role-based access control (RBAC) and audit trails post-authentication without requiring local credential storage or native MFA mechanisms.

SSO - OIDC, SAML 2.0, LDAP Integration with OIDC, SAML 2.0, and LDAP identity providers. Group-to-role mapping is supported.

Secrets & Credential Vault Built-in Fernet-encrypted vault for SSH keys, kubeconfigs, API tokens, registry credentials, and database connection strings. Scoped access with expiry policies.

Session Controls Configurable session timeouts and automatic logout. All active sessions are visible and revocable by administrators. Session activity is included in the audit log.

Least-Privilege Defaults New users and service accounts receive no permissions by default. Access is explicitly granted through roles or group mappings - never assumed or inherited.

4. Secrets Management & Internal PKI

OptimusHub includes a built-in secrets vault and a full internal Certificate Authority - no third-party tools required.

Secrets Vault

Secrets are encrypted using Fernet symmetric encryption (AES-128-CBC with HMAC-SHA256 authentication) before being written to storage
Secrets are never exposed in logs, UI output, or API responses after the moment of initial creation
All secret read, write, and delete operations are recorded in the audit trail
Vault access is controlled by RBAC - no user can access a secret outside their granted scope

Internal Certificate Authority (PKI)

OptimusHub includes a built-in PKI / internal CA for issuing, renewing, and revoking internal TLS certificates
Certificates can be issued to internal services, Kubernetes ingress, and developer workspaces without relying on external CAs or third-party tools like Vault PKI or DigiCert
Auto-renewal policies ensure certificates are rotated before expiry without manual intervention
Certificate issuance and revocation events are logged in the audit trail

5. Data Protection

Encryption in Transit

All communication between the OptimusHub frontend, control plane API, and managed infrastructure uses TLS 1.2 or higher. Internal service-to-service communication within the platform is encrypted. WebSocket SSH sessions are encrypted end-to-end through the platform's authenticated tunnel proxy.

Encryption at Rest

Secrets and sensitive metadata are encrypted using Fernet (AES-128-CBC with HMAC-SHA256 authentication). Persistent volumes and database stores rely on local host and volume-level encryption configured within your environment. Encryption keys are managed within your environment and never leave your control plane.

6. Audit Trail

Every action within OptimusHub - by users, administrators, service accounts, and automated processes - is recorded in the audit log. Records include:

Authenticated user identity, role, and session ID
Timestamp (UTC) and source IP address
Action performed and resource affected (namespace, cluster, secret, VM, etc.)
Result (success or failure) and error context
For SSH sessions: connection activity (commands run on the target machine are not recorded by OptimusHub)

Audit logs can be exported and forwarded to Grafana Loki. Retention and deletion controls depend on administrator permissions and your configuration.

7. Kubernetes Security

OptimusHub enforces security guardrails across all managed Kubernetes clusters:

Kubeconfig distribution is managed centrally - team members receive scoped, namespace-limited credentials rather than cluster-admin access
Namespace-level access assigned per user and group by the platform administrator
All kubectl exec, kubectl logs, and pod shell access events are logged in the audit trail
Helm releases are tracked with full version history and deployment attribution
Pod Security Standards are configurable per namespace

8. Network Security

Air-gap capable: All platform components can be provisioned from an internal container registry; no outbound internet access is required at runtime.
Secure tunnel proxy: SSH console, browser VS Code workspaces, and internal web proxy access are brokered through an authenticated tunnel - no direct inbound exposure to internal services.
No VPN required for internal access: The internal web proxy allows teams to access Grafana, Gitea, and other internal UIs through OptimusHub without opening VPN access.
Network segmentation: Platform components are designed to run in isolated network segments with explicit ingress/egress rules.
Ingress hardening: The platform's web interface is intended to sit behind a customer-managed reverse proxy or load balancer with TLS termination and WAF controls.

For the full operational picture of running in a disconnected network, see air-gapped infrastructure operations.

9. Operational Security of This Website

The OptimusHub marketing website (optimushub.net) is served as a static build via Nginx and is securely delivered through Cloudflare edge infrastructure, with the following controls:

HTTPS enforced via HSTS (Strict-Transport-Security)
X-Frame-Options: SAMEORIGIN (clickjacking protection)
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer-when-downgrade
Anonymous aggregate traffic analytics only (Google Analytics and Cloudflare Web Analytics); no advertising cookies or advertising pixels. See the Privacy Policy

10. Responsible Disclosure

Security Vulnerability Reporting

If you discover a security vulnerability in OptimusHub or on this website, please report it responsibly before any public disclosure. We take all reports seriously and will respond promptly.

Contact: [email protected]

Please include in your report:

A description of the vulnerability and its potential impact
Steps to reproduce, including any relevant proof-of-concept
Your contact information (if you wish to be credited)

Our commitment:

We will acknowledge receipt within 2 business days
We will keep you informed of our progress toward a fix
We will not pursue legal action against researchers who report in good faith
We will credit you in release notes if you wish (with your permission)

11. Security Contact

For security-related questions, vulnerability reports, security documentation requests, or to discuss our security architecture during a procurement evaluation:

Security team: [email protected]
General contact: [email protected]

Enterprise customers requiring a security architecture review, controls documentation, or a dedicated walkthrough of our security architecture should contact [email protected]. We are happy to provide detailed materials under NDA.