Security & trust

We test you to a standard. Here’s ours.

This is what we’re accredited for, how we handle your data, and where to report a concern about us.

Send us your security questions →Platform security →
01AccreditationCREST-accredited. Engagements run to OWASP, PTES, and NIST methodology by CREST-certified testers. Verify on the CREST registry ↗
02Compliance supportWe help you meet SOC 2, PCI-DSS, ISO 27001, HIPAA, and DORA testing expectations, and Incenter keeps coverage current between audits.
03Data handlingClient data is held to the minimum needed, access-controlled, and audit-logged. It stays within the residency and retention terms set in your agreement.
04Responsible disclosureA clear channel for reporting any security concern about OSec itself: email security@osec.com (also published in our /.well-known/security.txt).
Related

Your security team has questions. We have answers.

Due diligence
Send your questions
Vendor-security questionnaires and data-handling questions, answered directly.
Disclosure
Report a concern
Found something about OSec? Email security@osec.com — responsibly.