// OSSeva Assure
Open source support contracts.
Your CISO signs. Your auditor accepts.
OSSeva Assure is a support contract for the open source you run in production. It is Patch plus the architectural and compliance layer: patched builds for current and end-of-life versions, annual configuration audits, upgrade planning, and documentation written for SOC 2, HIPAA, PCI and ISO 27001 audits.
Trusted globally by enterprises
What an OSSeva support contract covers
One contract, one renewal date and one escalation path across PostgreSQL, MySQL, MariaDB, MongoDB, Redis, Kafka, RabbitMQ, Spring and the other technologies we cover. End-of-life versions are part of the contract, so bringing a system under support does not force an upgrade first.
Patched builds
Quarterly CVE patches for every covered version, current and end-of-life, with out-of-cycle releases for CVSS 9+ issues. Signed artifacts arrive through the package, Maven, Helm or OCI registry you already use, with vulnerability disclosure notifications.
Architecture and upgrades
An annual configuration and architecture audit of your deployment, a reference architecture, and an upgrade plan for each technology, worked out with a named architecture consultant.
Audit evidence
Compliance packages for SOC 2, HIPAA, PCI DSS and ISO 27001, a pen-test validation summary, and the SBOMs and CVE remediation records that show an auditor what was fixed, when, and in which build.
How an Assure engagement starts
Discovery call
We confirm the technologies, versions and clusters in scope, and which compliance frameworks your auditors work to.
Architecture review
Every Assure engagement begins with a review of your deployment that finds configuration-level security gaps and records each one with a recommended fix.
Evidence and plan
You receive the compliance documentation and an upgrade plan per technology. The review repeats every year and after major configuration changes.
What's included
- Everything in OSSeva Patch
- Annual configuration & architecture audit
- Version upgrade planning & migration plan
- SOC 2 Type II attestation package
- HIPAA technical safeguard matrix
- PCI DSS evidence package
- ISO 27001 control mapping
- FedRAMP-aligned documentation
- Pen-test validation summary
- Named architecture consultant
- Reference architecture for your deployment
- Dependency compatibility audit
Compliance frameworks covered
SOC 2 Type II
Service organization control report for security, availability, and confidentiality.
HIPAA
Technical safeguard mapping for covered entities and business associates.
PCI DSS
Evidence package for Requirement 6 (secure systems) and Requirement 11 (testing).
ISO 27001
Control mapping to Annex A for vulnerability management and patch processes.
FedRAMP-aligned
Documentation aligned to NIST 800-53 controls for federal agency use.
Assure scope by technology
The tier is the same everywhere, but the audit and the upgrade plan are written for each project. A few examples, with the full tier scope and covered versions on each technology page:
PostgreSQL support
Major-version migration planning to 17 or 18, a performance and vacuum configuration audit, and Oracle-to-Postgres migration design.
MySQL support
An upgrade plan from 5.7 or 8.0 to 8.4 and then 9.7 using MySQL Shell's upgrade checker, plus a review of mysql_native_password accounts before 8.4.
MongoDB support
An authentication, TLS and network exposure review, a featureCompatibilityVersion upgrade plan and a driver compatibility audit.
Kafka support
A cluster configuration audit, a throughput and latency review, and migration design from Confluent Platform. Kafka Connect and Streams patches are included.
RabbitMQ support
An annual configuration and architecture audit, version upgrade planning, and a reference architecture for your deployment.
Redis support
ACL and authentication audit, a persistence (RDB and AOF) security review, and a Redis Cluster topology review.
Spring Boot support
A Spring Boot 3 migration readiness assessment, a Java version upgrade sequence, and Spring Security reconfiguration guidance.
Elasticsearch support
A security and network exposure review, and a reindex and client plan for 8.x or OpenSearch.
Need 24/7 support?
Assure does not include 24/7 managed operations or an incident response SLA. If you need engineers on call around the clock with a 15-minute P1 response, that is OSSeva Operate, which includes everything in Assure.
Pricing: per cluster
OSSeva Assure is priced per cluster, across every technology on the contract. For databases, the database support cost calculator compares your current spend using your own figures. Book a discovery call for a quote.
Frequently asked questions
What compliance frameworks does OSSeva Assure cover?
OSSeva Assure compliance documentation covers: SOC 2 Type II (Trust Services Criteria CC6, CC7, CC8), PCI DSS v4.0 (Requirements 6.3 and 12.3), HIPAA Security Rule (§164.312 Technical Safeguards), ISO 27001:2022 (Annex A.8 Technological Controls), EU DORA (ICT risk management requirements for financial entities), and FedRAMP Moderate (AC, SI, and SA control families). Documentation is reviewed annually and updated at each major patch release.
What does an OSSeva compliance attestation letter contain?
An OSSeva attestation letter includes: the technology and version covered, the CVEs addressed in the current patch cycle with CVSS scores, the patch delivery date and build identifier, OSSeva's assertion that the patched build has been tested for the applicable CVEs, a statement of ongoing patch commitment for the engagement period, and an OSSeva compliance team signature. It is designed to be provided directly to auditors as third-party assurance evidence.
Does OSSeva Assure include an architectural review?
Yes. OSSeva Assure engagements begin with a deployment architecture review that identifies configuration-level security gaps — for example, RabbitMQ management ports exposed to broad network segments, PostgreSQL roles with excessive privilege, or Kafka inter-broker communication without TLS. Findings are documented with remediation recommendations. The review is repeated annually and on major configuration changes.
Our auditors require a vendor SOC 2 report. Does OSSeva have one?
OSSeva's SOC 2 Type II report is available under NDA for qualified prospects and active customers. The report covers OSSeva's patch development, build, and delivery pipeline. Contact your account representative or reach out via the discovery call process to request a copy.
What does an OSSeva open source support contract include?
OSSeva Assure includes everything in OSSeva Patch: quarterly CVE patches as signed builds for current and end-of-life versions, plus vulnerability disclosure notifications. On top of that come an annual configuration and architecture audit, upgrade planning for each technology, a named architecture consultant and the compliance evidence auditors ask for. One contract covers every technology in scope.
Does OSSeva Assure include 24/7 support?
No. Assure does not include 24/7 managed operations or an incident response SLA. Round-the-clock coverage with a 15-minute P1 response is part of OSSeva Operate, which includes everything in Assure.
How is OSSeva Assure priced?
OSSeva Assure is priced per cluster, with every covered technology on one contract and one renewal date. Book a discovery call for a quote.
Get your compliance documentation ready this quarter.
Start with a discovery call. We confirm your frameworks, define the evidence package, and deliver audit-ready documentation within 60 days.