Trust center Updated 3 November 2026

OKStatus security, no grey areas.

Where your data lives, who can reach it, what is in place and what is not yet. The answers we give to security reviews, openly available.

Request the security pack Report a vulnerability

Published by ClearCloud SAS · Dijon, France · SIREN 539 932 731

Controls

32 controls in place, across 8 areas.

Each measure in detail, and what is not in place yet, in the Controls tab.

Infrastructure

5 in place
  • Platform hosted in France Applications, database and identities at Scaleway, Paris (PAR2).
  • Backups at another provider PostgreSQL backed up continuously at OVHcloud, Gravelines, with point-in-time recovery.
  • Status page off-infrastructure status.okstatus.eu runs at another host, on another site, with its own probes: it stays readable when the platform is not.
  • Infrastructure as code The whole infrastructure is versioned in Git: a competent operator can rebuild it.
  • Probes isolated by region Each probe authenticates with its own credential and only receives the checks of its region.

Encryption

4 in place
  • TLS 1.2+ everywhere HSTS on every public host.
  • Customer secrets encrypted at rest Monitor credentials, alert-channel tokens and API keys in AES-256-GCM, under a key stored apart from the data.
  • Encrypted backups Server-side, AES-256.
  • End-to-end encrypted push Web Push (RFC 8291): the browser's push service cannot read the content.

Access & identity

4 in place
  • Keycloak sign-in Password, social sign-in or your own identity provider.
  • SAML / OIDC SSO On the Enterprise plan.
  • TOTP two-factor authentication Available for every account, enforceable per organisation, mandatory for our staff console.
  • Roles enforced server-side Owner, admin, member, viewer.

Audit trail

4 in place
  • Full audit log Every create, update and delete: who, what, when, from where.
  • CSV export of the log In the dashboard, on the Enterprise plan.
  • Staff actions logged separately
  • Self-hosted audience measurement Matomo at matomo.clearcloud.fr, in France, without measurement cookies.

Backup & continuity

4 in place
  • RPO 15 minutes · RTO 4 hours At most 15 minutes of data lost, service back in under 4 hours.
  • Restore tested every quarter Last test on 28 September 2026: full database restored in 2 min 22 s.
  • 30 days of backup retention
  • 90 days' notice if we stop Service kept running and export open during the notice, pro-rata refund (Terms, art. 9.3).

Software supply chain

4 in place
  • Images rebuilt from pinned bases
  • Vulnerability scan in CI A CRITICAL vulnerability blocks the image from being published.
  • Daily rescan in the cluster
  • Dependency audit on every build

Data & privacy

4 in place
  • Retention limited by plan 90 days, 6, 12 or 24 months depending on the plan, then deleted automatically every day.
  • JSON export at any time On every plan. REST API and Terraform as well on Max and Enterprise.
  • Returned or deleted within 30 days At the end of the contract.
  • No third-party support, CRM or error-tracking tool None of them receives your data.

Responsible disclosure

3 in place
  • security.txt published /.well-known/security.txt, RFC 9116.
  • Acknowledged within 2 business days
  • No legal action commitment For good-faith research, without data destruction, privacy violations or service disruption.

Not in place yet

2 gaps
  • SOC 2 or ISO 27001 certificationOn the roadmap, not obtained.
  • Third-party penetration testInternal test done on 3 November 2026; a test by an independent pentester is planned.