Live trust report
We audit our own cloud
We hold ourselves to the same standard we ship to customers. The numbers below are from running the OpsVision compliance engine against our own production AWS account — the same code our customers run. They are real and point-in-time, and they include the open findings we're still working through. A score below 100 means we have work to do; we publish it rather than hide it. This is not a certification.
Our live posture
OpsVision Prod (self-audit) · ap-south-1 · as of 2026-09-16
DPDP Act (India)
80%31 automated controls (full framework coverage).
6 open findings
1 of 2 evidence documents current
CIS AWS Foundations Benchmark v3.0.0
97%62 controls — 55 automated, 7 manual evidence (operational legs CIS requires uploads for).
9 open findings
7 of 7 evidence documents current
ISO/IEC 27001:2022
99%92 of 93 Annex A controls — 19 automated cloud-config checks + 73 evidence-collection workflows. Industry-standard ISMS shape (matches Drata / Vanta / Tugboat). OpsVision provides the audit tooling; the customer is the audited entity.
3 open findings
73 of 73 evidence documents current
SOC 2 Type II (Trust Services Criteria 2017)
99%33 of 33 Common Criteria addressed — 9 automated cloud-config checks + 24 evidence-collection workflows. The 24 are organisational criteria no cloud API can attest to and require document evidence. CC8.1 is covered by an origin-discipline proxy (IaC/pipeline vs interactive console), not change-ticket correlation. OpsVision provides the audit tooling; the customer is the audited entity. Not a SOC 2 attestation.
3 open findings
24 of 24 evidence documents current
SEBI Cyber Security and Cyber Resilience Framework (CSCRF 2024)
100%17 automated cloud-config checks + 22 evidence-collection workflows across the five Cyber Capability functions. CSCRF is GRADED by entity category (MII / Qualified / Mid-size / Small) and OpsVision does not know yours, so the MII standards are shown for completeness. Not a SEBI filing and not a Cyber Capability Index score — the CCI is assessed by an independent auditor.
1 open finding
19 of 22 evidence documents current
HIPAA Security Rule (45 CFR Part 164 Subpart C) + HITECH Act
97%19 automated cloud-config checks + 27 manual evidence anchors across §§ 164.308-164.316 and the HITECH breach-notification sections. There is no HIPAA certification — HHS certifies no one. The Security Rule is deliberately flexible (§ 164.306(b)), so a passing check cannot show an addressable specification was correctly implemented, substituted, or documented as not reasonable: that turns on your own risk analysis, which OpsVision has not seen.
7 open findings
27 of 27 evidence documents current
PCI DSS v4.0
99%21 automated cloud-config checks + 23 evidence-collection workflows across the 12 Requirements. Not a RoC, AoC or SAQ — PCI DSS is validated by a QSA against a cardholder data environment you define. Req-12.5 makes that scope the foundation every other result rests on, and OpsVision does not determine your CDE.
3 open findings
22 of 23 evidence documents current
GDPR (EU 2016/679)
100%9 automated cloud-config checks + 31 evidence-collection workflows across the audit-relevant Articles. There is no GDPR certificate — compliance is a legal determination only a supervisory authority can make. Article 32(1) technical measures are what a cloud scan can speak to; lawfulness, data-subject rights and transfers are documentary.
0 open findings
31 of 31 evidence documents current
Scope: a read-only audit of OpsVision's own production AWS account against DPDP Act (India), CIS AWS Foundations Benchmark v3.0.0, ISO/IEC 27001:2022, SOC 2 Type II (Trust Services Criteria 2017), SEBI Cyber Security and Cyber Resilience Framework (CSCRF 2024), HIPAA Security Rule (45 CFR Part 164 Subpart C) + HITECH Act, PCI DSS v4.0, GDPR (EU 2016/679), scored the same way a customer's account is. Many open findings are configuration items on a minimal, static-site account (services we don't run, Control Tower-managed defaults). We're working them down in the open. This is a self-audit, not a third-party certification.
The percentage above covers the automated checks only. Where a framework is largely documentary — ISO 27001 and GDPR most of all — that is a minority of it, and the evidence count beside each framework is the rest of the picture. That count means a document is attached: not that the control is satisfied, that the document is current, or that an auditor would accept it.
2 further frameworks are audited on this account but not shown above — being remediated to the internal release bar before publication. Published frameworks are never removed for scoring badly.
What we operate today
Don't take our word for it
Beyond the self-audit above, here is a set of security controls already live on this site — each one reproducible from your own terminal. Run the command next to each item and check the result for yourself.
HSTS, preload-eligible
Strict-Transport-Security with a 1-year max-age, includeSubDomains, and preload — browsers are told to only ever reach us over HTTPS.
$ curl -sI https://www.opsvision.ai/ | grep -i strict-transportContent-Security-Policy
default-src 'self' with frame-ancestors 'none'. This is not a strict CSP: script-src and style-src allow 'unsafe-inline' as a pragmatic concession to our Next.js static export. We say so plainly rather than imply a tighter policy than we run.
$ curl -sI https://www.opsvision.ai/ | grep -i content-securityClickjacking & MIME-sniffing defenses
X-Frame-Options: DENY and X-Content-Type-Options: nosniff on every response.
$ curl -sI https://www.opsvision.ai/ | grep -iE 'x-frame|x-content'Referrer-Policy
strict-origin-when-cross-origin — we don't leak full URLs to third-party sites.
$ curl -sI https://www.opsvision.ai/ | grep -i referrer-policyPermissions-Policy
Geolocation, camera, microphone, and payment APIs are all denied for this site.
$ curl -sI https://www.opsvision.ai/ | grep -i permissions-policysecurity.txt (RFC 9116)
A published security.txt points researchers at our monitored security@opsvision.ai inbox.
$ curl -s https://www.opsvision.ai/.well-known/security.txtAmazon-issued TLS certificate
TLS is terminated with a certificate issued by Amazon (ACM) — check the issuer yourself.
$ openssl s_client -connect www.opsvision.ai:443 -servername www.opsvision.ai </dev/null 2>/dev/null | openssl x509 -noout -issuerHTTP/2 + forced HTTPS
The site is served over HTTP/2, and plain HTTP is 301-redirected to HTTPS.
$ curl -sI https://www.opsvision.ai/ | head -1$ curl -sI http://www.opsvision.ai/ | head -2
These are the controls we can prove from outside today — nothing more. For our intended posture and what's still in progress, see the security page.