Security

Last updated: June 1, 2026

1. Architecture

0scp is sold as an AWS Marketplace SaaS Contract and deployed as serverless infrastructure into the customer's own AWS account. Your security data does not leave your account. The only seller-hosted component is a minimal licensing service that validates entitlement.

2. Data isolation

Each customer's platform runs in their own account boundary. Cross-account access, when used for Organization governance, is scoped to least-privilege roles created by the customer-deployed stack.

3. Authentication

The customer portal authenticates through Amazon Cognito. Access tokens are presented as bearer credentials to the licensing API, which authorizes requests by Cognito group membership (customers vs. administrators).

4. Licensing integrity

License keys are HMAC-signed. Runtime validation is cached and fails open during transient outages so that a seller-side disruption cannot silently disable a customer's guardrails.

5. Vulnerability disclosure

We welcome responsible disclosure. Please report suspected vulnerabilities to security@0scp.com. Do not file public issues for security matters. We aim to acknowledge reports within one business day.

6. Compliance

0scp itself ships controls aligned to common security benchmarks. Formal third-party attestations (e.g., SOC 2) are listed here when available.