Security

Last updated: May 2026

OptimusHub is designed from the ground up for high-security, regulated, and air-gapped environments — including sovereign infrastructure, defense networks, and organizations where public cloud access is not permitted or not desired. Security is a first-class platform concern at every layer of the architecture.

SOC 2 Ready Air-Gap Native Self-Hosted Zero External Telemetry Immutable Audit Trail Fernet-Encrypted Vault Built-In PKI / CA TLS 1.2+

1. Deployment Architecture

OptimusHub runs entirely within your infrastructure. The platform has no mandatory external dependencies — it is designed to operate with zero internet egress in fully air-gapped environments.

All data, credentials, secrets, and audit records remain within your controlled environment at all times
No telemetry, diagnostic information, usage data, or licensing pings are transmitted to OptimusHub or any third party
Platform updates are delivered as versioned, signed container images that can be transferred via portable media into air-gapped environments
The control plane API is not externally reachable; access is scoped to your internal network by design
Air-gapped cluster import wizard allows importing Kubernetes clusters without any internet access requirement

2. SOC 2 Alignment

OptimusHub is architected to satisfy the Trust Services Criteria for Security (CC), Availability (A), and Confidentiality (C) under AICPA SOC 2. The following controls are native to the platform:

CC6 — Logical Access RBAC with least-privilege defaults. Namespace-level Kubernetes access grants. SSO with MFA enforcement. All access explicitly granted, never inherited.

CC7 — System Operations Immutable audit trail for every platform action. Alert rules with SMTP delivery. Deployment log streaming and SSH session audit.

CC8 — Change Management All deployments, Helm releases, and configuration changes are logged with actor identity, timestamp, and result. Changes are traceable and attributable.

CC9 — Risk Mitigation Encrypted secrets vault. Internal PKI/CA for certificate lifecycle. No single-point secrets exposure — credentials never appear in logs or API responses after creation.

A1 — Availability DR planning with RTO/RPO targets, DRS affinity groups, and database backup policies with encrypted storage and cron scheduling.

C1 — Confidentiality Fernet-encrypted secrets vault. TLS 1.2+ in transit. AES-256 at rest. Scoped credential access with expiry. No data leaves the customer's environment.

3. Identity and Access Control

Role-Based Access Control (RBAC) Three built-in roles plus custom roles with granular per-feature permissions. Namespace-level Kubernetes access grants — viewer or manager per namespace per user.

Multi-Factor Authentication (MFA) MFA enforcement at the platform level for all users. TOTP-based authenticators supported. Configurable enforcement policies per role or group.

SSO — LDAP, OIDC, SAML Native integration with LDAP, Active Directory, OIDC-compatible providers (Keycloak, Dex, Okta), and SAML 2.0. Group-to-role mapping supported across all providers.

Secrets & Credential Vault Built-in Fernet-encrypted vault for SSH keys, kubeconfigs, API tokens, registry credentials, and database connection strings. Scoped access with expiry policies.

Session Controls Configurable session timeouts and automatic logout. All active sessions are visible and revocable by administrators. Session activity is included in the audit log.

Least-Privilege Defaults New users and service accounts receive no permissions by default. Access is explicitly granted through roles or group mappings — never assumed or inherited.

4. Secrets Management & Internal PKI

OptimusHub includes a built-in secrets vault and a full internal Certificate Authority — no third-party tools required.

Secrets Vault

Secrets are encrypted using Fernet symmetric encryption (AES-128-CBC with HMAC-SHA256 authentication) before being written to storage
Secrets are never exposed in logs, UI output, or API responses after the moment of initial creation
All secret read, write, and delete operations are recorded in the immutable audit trail
Vault access is controlled by RBAC — no user can access a secret outside their granted scope

Internal Certificate Authority (PKI)

OptimusHub includes a built-in PKI / internal CA for issuing, renewing, and revoking internal TLS certificates
Certificates can be issued to internal services, Kubernetes ingress, and developer workspaces without relying on external CAs or third-party tools like Vault PKI or DigiCert
Auto-renewal policies ensure certificates are rotated before expiry without manual intervention
Certificate issuance and revocation events are logged in the audit trail

5. Data Protection

Encryption in Transit

All communication between the OptimusHub frontend, control plane API, and managed infrastructure uses TLS 1.2 or higher. Internal service-to-service communication within the platform is encrypted. WebSocket SSH sessions are encrypted end-to-end through the platform's authenticated tunnel proxy.

Encryption at Rest

Sensitive data — including secrets, SSH keys, kubeconfigs, and database credentials — is encrypted at rest. Encryption keys are managed within your environment and never leave your control plane. Database backup files are stored with encryption enabled by default.

6. Immutable Audit Trail

Every action within OptimusHub — by users, administrators, service accounts, and automated processes — is recorded in a tamper-evident, append-only audit log. Records include:

Authenticated user identity, role, and session ID
Timestamp (UTC) and source IP address
Action performed and resource affected (namespace, cluster, secret, VM, etc.)
Result (success or failure) and error context
For SSH sessions: full session metadata and command log

Audit logs cannot be edited or deleted through the standard platform UI. They are exportable as structured JSON and can be forwarded to external SIEM systems (Splunk, Elastic, Grafana Loki) via syslog or webhook. This audit architecture is designed to satisfy SOC 2 CC7 and support forensic investigation requirements.

7. Kubernetes Security

OptimusHub enforces security guardrails across all managed Kubernetes clusters:

Kubeconfig distribution is managed centrally — team members receive scoped, namespace-limited credentials rather than cluster-admin access
Namespace-level RBAC enforcement: viewer or manager per namespace per user — no cross-namespace privilege escalation
All kubectl exec, kubectl logs, and pod shell access events are logged in the audit trail
Helm releases are tracked with full version history and deployment attribution
Pod Security Standards are configurable per namespace
Air-gapped cluster import requires no internet access on the cluster side

8. Network Security

Air-gap capable: All platform components can be provisioned from an internal container registry; no outbound internet access is required at runtime.
Secure tunnel proxy: SSH console, browser VS Code workspaces, and internal web proxy access are brokered through an authenticated tunnel — no direct inbound exposure to internal services.
No VPN required for internal access: The internal web proxy allows teams to access Grafana, Gitea, and other internal UIs through OptimusHub without opening VPN access.
Network segmentation: Platform components are designed to run in isolated network segments with explicit ingress/egress rules.
Ingress hardening: The platform's web interface is intended to sit behind a customer-managed reverse proxy or load balancer with TLS termination and WAF controls.

For the full operational picture of running in a disconnected network, see air-gapped infrastructure operations.

9. Operational Security of This Website

The OptimusHub marketing website (optimushub.net) is served as a static build via Nginx with the following controls:

HTTPS enforced via HSTS (Strict-Transport-Security)
X-Frame-Options: SAMEORIGIN (clickjacking protection)
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer-when-downgrade
No third-party tracking scripts, analytics pixels, or advertising cookies

10. Responsible Disclosure

Security Vulnerability Reporting

If you discover a security vulnerability in OptimusHub or on this website, please report it responsibly before any public disclosure. We take all reports seriously and will respond promptly.

Contact: [email protected]

Please include in your report:

A description of the vulnerability and its potential impact
Steps to reproduce, including any relevant proof-of-concept
Your contact information (if you wish to be credited)

Our commitment:

We will acknowledge receipt within 2 business days
We will keep you informed of our progress toward a fix
We will not pursue legal action against researchers who report in good faith
We will credit you in release notes if you wish (with your permission)

11. Security Contact

For security-related questions, vulnerability reports, SOC 2 documentation requests, or to discuss our security architecture during a procurement evaluation:

Security team: [email protected]
General contact: [email protected]

Enterprise customers requiring a security architecture review, controls documentation, or a dedicated walkthrough of our SOC 2 posture should contact [email protected]. We are happy to provide detailed materials under NDA.