Live trust report

We audit our own cloud

We hold ourselves to the same standard we ship to customers. The numbers below are from running the OpsVision compliance engine against our own production AWS account — the same code our customers run. They are real and point-in-time, and they include the open findings we're still working through. A score below 100 means we have work to do; we publish it rather than hide it. This is not a certification.

Our live posture

OpsVision Prod (self-audit) · ap-south-1 · as of 2026-07-27

DPDP Act (India)

98%

31 automated controls (full framework coverage).

4 open findings · 2 manual-evidence

Critical: 0High: 0Medium: 4Low: 0

CIS AWS Foundations Benchmark v3.0.0

96%

62 controls — 55 automated, 7 manual evidence (operational legs CIS requires uploads for).

11 open findings · 7 manual-evidence

Critical: 0High: 0Medium: 7Low: 4

ISO/IEC 27001:2022

98%

92 of 93 Annex A controls — 25 automated cloud-config checks + 67 evidence-collection workflows. Industry-standard ISMS shape (matches Drata / Vanta / Tugboat). OpsVision provides the audit tooling; the customer is the audited entity.

4 open findings · 73 manual-evidence

Critical: 0High: 0Medium: 4Low: 0

SOC 2 Type II (Trust Services Criteria 2017)

99%

32 of 33 Common Criteria — 8 automated controls + 24 evidence-collection workflows. CC8.1 (change-correlation) signal in development. OpsVision provides the audit tooling; the customer is the audited entity.

3 open findings · 25 manual-evidence

Critical: 0High: 0Medium: 3Low: 0

Scope: a read-only audit of OpsVision's own production AWS account against CIS AWS Foundations Benchmark v3.0 and India's DPDP control set, scored the same way a customer's account is. Many open findings are configuration items on a minimal, static-site account (services we don't run, Control Tower-managed defaults). We're working them down in the open. This is a self-audit, not a third-party certification.

What we operate today

Don't take our word for it

Beyond the self-audit above, here is a set of security controls already live on this site — each one reproducible from your own terminal. Run the command next to each item and check the result for yourself.

  • HSTS, preload-eligible

    Strict-Transport-Security with a 1-year max-age, includeSubDomains, and preload — browsers are told to only ever reach us over HTTPS.

    $ curl -sI https://www.opsvision.ai/ | grep -i strict-transport

  • Content-Security-Policy

    default-src 'self' with frame-ancestors 'none'. This is not a strict CSP: script-src and style-src allow 'unsafe-inline' as a pragmatic concession to our Next.js static export. We say so plainly rather than imply a tighter policy than we run.

    $ curl -sI https://www.opsvision.ai/ | grep -i content-security

  • Clickjacking & MIME-sniffing defenses

    X-Frame-Options: DENY and X-Content-Type-Options: nosniff on every response.

    $ curl -sI https://www.opsvision.ai/ | grep -iE 'x-frame|x-content'

  • Referrer-Policy

    strict-origin-when-cross-origin — we don't leak full URLs to third-party sites.

    $ curl -sI https://www.opsvision.ai/ | grep -i referrer-policy

  • Permissions-Policy

    Geolocation, camera, microphone, and payment APIs are all denied for this site.

    $ curl -sI https://www.opsvision.ai/ | grep -i permissions-policy

  • security.txt (RFC 9116)

    A published security.txt points researchers at our monitored security@opsvision.ai inbox.

    $ curl -s https://www.opsvision.ai/.well-known/security.txt

  • Amazon-issued TLS certificate

    TLS is terminated with a certificate issued by Amazon (ACM) — check the issuer yourself.

    $ openssl s_client -connect www.opsvision.ai:443 -servername www.opsvision.ai </dev/null 2>/dev/null | openssl x509 -noout -issuer

  • HTTP/2 + forced HTTPS

    The site is served over HTTP/2, and plain HTTP is 301-redirected to HTTPS.

    $ curl -sI https://www.opsvision.ai/ | head -1
    $ curl -sI http://www.opsvision.ai/ | head -2

These are the controls we can prove from outside today — nothing more. For our intended posture and what's still in progress, see the security page.