Skip to main content

Data Isolation & Encryption

Overview​

OpsWorker is designed as a multi-tenant platform with strong data isolation between organizations and encryption for all data at rest and in transit.

Tenant Isolation​

Organization-Level Separation​

Each organization's data is isolated at the database level:

  • Investigation data, signals, and configurations are partitioned by organization
  • No cross-organization data access is possible through the application
  • Each organization has its own cluster tokens, integrations, and user accounts

Workspace Separation​

Within an organization, workspaces provide additional separation:

  • Users only see data from workspaces they're assigned to
  • Admin users can see all workspaces within their organization

Encryption​

At Rest​

Data StoreEncryption
Investigation data (DynamoDB)AWS-managed encryption (AES-256)
Investigation artifacts (S3)AWS-managed encryption (AES-256)
Configuration dataAWS-managed encryption

In Transit​

Communication PathEncryption
Alert webhooks → API GatewayTLS 1.2+
Agent ↔ SQSTLS 1.2+
Portal ↔ APITLS 1.2+
Internal service communicationTLS within AWS

Credential Handling​

  • No cluster credentials stored: OpsWorker doesn't have SSH keys, kubeconfig, or cloud provider credentials for your clusters
  • Cluster tokens: Used only for agent authentication; not Kubernetes credentials
  • Integration tokens: Stored encrypted (Slack OAuth, GitHub tokens, Datadog API keys)

Next Steps​