No direct connection between Octopai and your data source
We deal with metadata only - NOT data
Option for Azure or AWS secured worldwide dedicated Octopai VM
Single-directional push process
The user pushes metadata to Octopai’s environment, we do not have the ability to pull anything from the user’s systems
3 Levels of Cloud Security
1
Double Firewall - including IP filtering
2
Encryption in motion - HTTPS
3
Encryption at rest - Encrypted Virtual Machine Data Disks
Security Certifications
Octopai takes continuous measures to ensure compliance with industry best practices so that customers are never exposed to malicious code.
Data Center & Network Security
Octopai hosts all its software on Amazon Web Services (AWS) and Microsoft Azure. See AWS and Azure compliance and security documentation for more information.
All of Octopai’s servers are located on our own virtual private cloud (VPC), protected by restricted security groups allowing only the minimal required communication to and between servers.
Metadata Security
All connections to Octopai are encrypted using SSL, and any attempt to connect over HTTP is redirected to HTTPS. We maintain DigiCert SHA2 Extended Validation Server CA certification.
System passwords are encrypted using AWS KMS and Azure Key Vault with restricted access to specific production systems.
We use industry-standard SQL Server data storage systems hosted on AWS and Azure.
Octopai customers may configure a data retention duration and customer data is purged from Octopai systems following contract termination.
Application Security
Web application architecture and implementation follow OWASP guidelines.
In addition to Octopai’s extensive testing program, we conduct application penetration testing by a third party at least once per year.
Octopai login requires strong passwords. User passwords are salted, irreversibly hashed, and stored in Octopai’s database. Audit logging allows administrators to see when users last logged in and when passwords were last changed.
All access to Octopai applications is logged and audited, and logs are kept for at least one year.
