Security & Data
How Optivis Core protects your data
These protections are built into the platform.
Hosting
Optivis Core runs on servers in the United States.
Encryption in transit
All connections use TLS, with channel binding required.
Single sign-on
Sign in with Google, Microsoft, OIDC or SAML, secured with PKCE, state and nonce checks.
Multi-factor authentication
Authenticator-app codes (TOTP). MFA secrets are stored encrypted with AES-256-GCM.
Role-based access
Two layers: permissions per role, plus individual exceptions per user. All permissions are enforced on the server.
Audit log
Every change records who made it, what changed with full before and after values, IP address, user agent and retention period.
Data export
A built-in data subject request (DSR) module handles 5 request types. Data can also be exported through the API or as a full dump.