Security & Compliance

Overview

OpsWorker's security architecture is built on the principles of least privilege, defense in depth, and human oversight.

Control	Implementation
Read-only access	Agent runs with the built-in `view` ClusterRole (get/list/watch only)
No Secret values by default	By default the agent does not read Secret values; secret access is opt-in and disabled by default
Outbound-only communication	No inbound ports; agent polls SQS
No stored cluster credentials	Cluster token only; no kubeconfig in cloud
Minimal footprint	A default install runs three pods: the agent, the Kubernetes MCP server, and the Grafana MCP server

Control	Implementation
Serverless	No servers to patch or manage
Multi-tenant isolation	Logical, application-layer isolation by organization on shared DynamoDB tables
Encryption	At rest (AES-256, AWS-managed) and in transit (TLS, AWS default; not pinned to a minimum version by configuration)
Access control	Role-based access in portal (Admin and ReadOnly roles)
Audit logging	Investigation activities logged

Control	Implementation
Authentication	Auth0 (with Google social login)
Authorization	Role-based access control
Session management	Secure session handling via Auth0
API security	Authenticated API endpoints

OpsWorker never auto-executes commands on your cluster:

OpsWorker holds no certified compliance attestations today.

Standard	Status
SOC 2	On the roadmap, not yet certified. Contact OpsWorker for details.
Data residency	Data is hosted in the AWS region you select. Contact OpsWorker for a DPA and region options.

For specific compliance questions or security documentation requests, contact the OpsWorker team.