Trust center
OSSeva trust center.
What we can show your security review.
OSSeva holds a SOC 2 Type II report, available under NDA. Every patched build is signed, with GPG for packages and Maven artifacts and cosign for container images, and the key ID is public. OSSeva runs a vulnerability disclosure policy and delivers Assure compliance documentation within 60 days.
Last reviewed
Attestations and controls, as of today
This list holds only what OSSeva has today. Each item says where to check it.
SOC 2 Type II
The report is available under NDA to qualified prospects and active customers. It covers OSSeva's patch development, build and delivery pipeline. Request the security pack.
Signed builds
GPG key ID B7C4E831 for packages and Maven artifacts, Sigstore cosign for container images, and SHA-256 checksums for every release. The commands are on the security page.
Vulnerability disclosure policy
Report to security@osseva.io. We acknowledge within 24 hours and triage within 72 hours, and the policy includes a safe harbor for good-faith research. Read the policy.
Documentation within 60 days
Audit-ready compliance documentation for an Assure engagement is delivered within 60 days.
How patched builds are produced and signed
An end-of-life version gets no fixes from its upstream project, so OSSeva produces them. Each step leaves a record you can check.
| Step | What happens |
|---|---|
| 1. Track | OSSeva engineers monitor NIST NVD, GitHub Security Advisories and vendor mailing lists for the technologies we support. |
| 2. Backport | The upstream fix is backported to the release you run. Patches apply to upstream source, so there is no fork. |
| 3. Sign | Packages and Maven artifacts are signed with GPG key B7C4E831. Container images are signed with Sigstore cosign. SHA-256 checksums ship with every release, and each customer receives a signed attestation document confirming the expected hash before deployment. |
| 4. Deliver | Builds arrive through the repository manager you already use: Artifactory, Nexus or Harbor, or a Helm, Maven Central or OCI registry. |
| 5. Record | Every build ships with an SBOM, VEX statements and a CVE record that carries the delivery date and the build identifier. |
You can verify a build before it reaches production. These are the commands from the security page.
| Artifact | Command | What it proves |
|---|---|---|
| Package or Maven artifact | gpg --recv-keys B7C4E831, then gpg --verify <artifact>.asc | Signed by the OSSeva key and unchanged. |
| Container image | cosign verify --certificate-identity-regexp='.*@osseva.io' ghcr.io/osseva/<image>:<tag> | Carries an OSSeva cosign signature. |
| Any release file | shasum -a 256 <artifact>, compared with the SHA-256 file shipped with the release | Matches the published checksum. |
The patch tier page explains how builds ship, and the audit evidence guide shows what an auditor asks of an SBOM and a VEX statement.
Data and access model
OSSeva supports software that runs on your own infrastructure. Your clusters, accounts and data stay with you in every tier. What changes by tier is how much OSSeva does on them.
| Tier | How OSSeva works with your estate |
|---|---|
| Patch | Signed builds arrive through your repository manager and you deploy them. Production needs no outbound internet access. |
| Assure | Adds a review of your deployment, upgrade planning and 24/7 reactive support. Assure does not monitor or run your clusters. |
| Operate | Adds 24/7 monitoring and operations. OSSeva works through the access you grant, and the account and its data stay yours. |
Documentation for your auditors
Assure includes compliance documentation written for SOC 2, HIPAA, PCI DSS and ISO 27001 audits, delivered within 60 days, next to the SBOMs, VEX statements and CVE records that come with each build. The audit acceptance guide shows how auditors review it, and the compliance matrix sets it against each framework. Reading as a CISO? Start with the CISO page.
Request the security pack
Use the request button to ask for the SOC 2 Type II report under NDA. Tell us which supplier review or audit it supports. For contract terms, the SLA page sets patch times, response times and scope by tier, the procurement guide lists what to require from any open source support vendor, and the enterprise page shows how a large contract is bought.
When this page may not be enough
You need a vendor that hosts and secures your data
OSSeva supports software you run on your own infrastructure. A managed service from your cloud provider fits better if you want the vendor to host it.
Your review needs an attestation this page does not list
Ask before you assume it exists. The list above is complete as of the date on this page, and a discovery call will tell you straight whether a requirement is covered.
Do you have SOC 2 Type II?
Yes. OSSeva's SOC 2 Type II report is available under NDA for qualified prospects and active customers. It covers OSSeva's patch development, build and delivery pipeline. Use the security pack request or the discovery call to ask for a copy.
Do your engineers access our systems?
It depends on the tier. With Patch, builds arrive through your repository manager and you deploy them. Assure reviews your deployment and does not monitor or run your clusters. Operate works through the access you grant, and the account and its data stay yours. The software runs on your infrastructure in every case.
How are patched builds signed?
Packages and Maven artifacts are signed with GPG key B7C4E831. Container images are signed with Sigstore cosign. Every release also ships with SHA-256 checksums. The verification commands are on the security page.
Where do I report a vulnerability?
Email security@osseva.io. We acknowledge reports within 24 hours and triage within 72 hours. Encrypt sensitive reports with the OSSeva PGP key, ID B7C4E831.
Get a quote
Request the security pack.
Tell us which supplier review or audit you are preparing for. Prefer to talk first? Book a 15-minute call.