Security at Ostral

Introduction

The security of information systems and the confidentiality of our customers' data are at the core of Ostral's engineering. This page details the technical and organizational measures (TOMs) implemented to ensure the integrity, availability, and confidentiality of the service.

Architecture and Hosting

  • Data Location: All of our hardware and software infrastructure is hosted within the European Union.

  • Logical Isolation: The architecture is based on a multi-tenant model where each customer's data is strictly and logically separated at the database and application levels

  • .Availability: Our infrastructure is distributed across multiple availability zones to prevent hardware failures and guarantee our Service Level Agreement (SLA).

Data encryption

  • Data in Transit: All network communications between the Ostral Agent, the Console, and our servers, as well as our internal services, are encrypted using TLS 1.2 minimum protocols (TLS 1.3 preferred).

  • Data at Rest: All databases, storage volumes, and backups are encrypted using the AES-256 algorithm.

Access Control and Authentication

  • Least Privilege: Access to production environments is strictly limited to engineers whose duties require it. Access is immediately revoked upon departure or role change.

  • Strong Authentication: Access to critical systems, source code, and cloud infrastructure requires mandatory multi-factor authentication (MFA) and the use of physical security keys.

  • Audit Logging: Access to production databases is technically logged and retained for 12 months.

Secure Development

  • Code Review: Every modification to the Agent or Console code is subject to a peer review before deployment to production.

  • Software Composition Analysis (SCA): We continuously scan our open-source dependencies to identify and remediate public vulnerabilities (CVEs).

  • Agent Integrity: The Ostral extension code is cryptographically signed. Updates are delivered through the browsers' native, verified channels.

Audits and Incident Management

  • Penetration Testing: We commission an independent auditing firm at least once a year to perform penetration tests on the Console, API, and Agent. The executive summary is available to our customers upon request.

  • Incident Response: We maintain a documented incident response plan. In the event of a confirmed data breach, our customers are notified within a maximum of 72 hours.

Contact

For any question about this policy, please write to:

privacy@ostral.ai