VerOps
Get started
Security

Security and data protection

This page describes the controls built into the VerOps platform, as they work in the product today. For hosting, sub-processor or contractual questions, contact us and we will answer them directly.

Get started Read the documentation
Isolation
Per organisation, in every query
Access
Roles with view and manage rights
Sign-in
TOTP multi-factor authentication
Secrets
AES-256-GCM at rest

Tenant isolation

  • Every telemetry query is scoped

    Queries against the telemetry store carry a mandatory organisation filter. A query with no organisation set fails instead of returning data.

  • A second layer in the database

    Each organisation has its own database user with row policies, so the store itself also limits what can be read.

  • Application records too

    Configuration records carry an organisation ID, and a filter is applied to every repository call.

  • Keys carry the tenant

    Ingest keys identify the organisation. Agents and SDKs never send an organisation ID of their own.

Access control and sign-in

  • Role-based access

    Permissions are set per module as view or manage. Admin, Member and Viewer are built in, and you can create custom roles.

    Documentation

  • Multi-factor authentication

    TOTP codes from any authenticator app. Admins can reset a member’s MFA.

  • Passwords

    Stored as bcrypt hashes, never in plain text.

  • Bot protection

    Sign-in and sign-up are protected by a CAPTCHA challenge.

  • Sessions expire

    Signed session tokens expire, by default after 24 hours.

  • Vera follows the same rules

    The assistant acts with the permissions of the user asking, and changes it proposes wait for approval.

    Learn more

Keys, secrets and agents

  • Stored secrets are encrypted

    Integration, cloud, notification-channel, AI-provider, SNMP and directory credentials are encrypted at the field level with AES-256-GCM.

  • Synthetic test credentials

    Logins used by synthetic tests live in a separate credential vault with its own encryption keys.

  • API keys are hashed

    Keys are shown once and stored as SHA-256 hashes. Each key can carry its own permissions and an expiry date.

  • Agents connect outbound

    Agents call VerOps; you never open an inbound port for them.

    Documentation

  • Device enrolment

    Scout enrols with a limited-use, expiring token and receives its own device key, which is stored hashed and can be revoked per device.

    Documentation

  • Read-only Kubernetes access

    The Kubernetes agent’s cluster role only gets, lists and watches resources.

Control over your data

  • Drop data at ingest

    Ingestion filters discard logs, spans or metrics you do not want before they are stored.

    Documentation

  • Retention per organisation

    Retention is enforced per organisation by scheduled deletion jobs that cover rollups as well as raw data.

  • Share links you can revoke

    Dashboard share links are signed, read-only, stored as hashes, and can expire or be revoked.

  • Least-privilege cloud access

    AWS can connect through cross-account role assumption and Azure through app consent, so you do not have to hand over long-lived keys.

    Documentation

Limits worth knowing

  • Single sign-on (SAML or OIDC) is not available today. Sign-in is by email and password with TOTP MFA.
  • For hosting location, sub-processors, certifications or a security questionnaire, contact us.
Documentation

Read more in the docs

Try it on your own systems

Create a workspace, or tell us about your environment and we will walk you through it.

Get started Talk to sales