SOC 2
Type II
Independently audited controls for security, availability and confidentiality over time.
Trust center
Autonomous,and accountable.
How OpenAna protects your code and data, where Ana can run, and how every action it takes is gated, approved and recorded.
✓ SOC 2 Type II✓ ISO 27001✓ HIPAA✓ GDPR
SOC 2
Type II
+ ISO 27001 · HIPAA · GDPR
Compliance
SOC 2 Type II, ISO 27001, HIPAA & GDPR
Audited controls for security, availability and confidentiality, privacy by design, and reports available under NDA.
Deployment
SaaS, your VPC, on-prem or air-gapped
Run Ana where your policies say it must run, with data residency under your control.
Data
No training on your data
Your code, findings and telemetry are used to do your work - never to train models.
Control
Approvals before action
Policy gates, named approvers and a decision log for everything Ana does.
Compliance
Audited, certified,
and on the record.
Reports and certificates are shared with customers and prospects under NDA.
ISO
27001
A certified information security management system covering people, process and technology.
HIPAA
Compliant
Safeguards for protected health information, so healthcare and life-sciences teams can use Ana.
GDPR
Compliant
Lawful processing, data subject rights and data residency for personal data of people in the EU.
Deployment
Run Ana where
your policy says.
Same engineers, same guardrails - four ways to deploy.
Isolation
SaaS
Fastest start. Managed by OpenAna, with SSO, role-based access and scoped, read-only-first connections.
Isolation
Your VPC
Ana runs inside your own cloud account. Code and data stay within your environment and network boundary.
Isolation
On-prem
Run Ana in your own data center for complete isolation and control.
Isolation
Air-gapped
For regulated and classified environments with no outbound connectivity.
Data handling
Your data does your work. Nothing else.
- Read-only by default
- Connections start read-only. Write access is opt-in, scoped, and every write goes through your approval rules.
- Least privilege
- Scoped tokens, service accounts and OAuth apps per integration - never shared admin credentials.
- No training on your data
- Customer code, findings and telemetry are not used to train models.
- Data residency
- Choose where data is processed and stored; in VPC and on-prem deployments it never leaves your environment.
- Changes through your process
- Ana acts through pull requests and your CI/CD, so your branch protection, reviews and change windows still apply.
- Full audit trail
- Every action, approval and result is recorded and exportable as evidence.
Governance
Autonomy with
a human in charge.
Policy-based gating
Every action is classified by risk; your policies decide what Ana may do on its own and what needs a person.
Learn more →Named approvers
Sensitive changes - IAM, network, production, data - route to the specific people your policy names.
Learn more →Decision log
Who approved what, when, and with which evidence - kept for audits and post-incident reviews.
Learn more →In the IDE, too
Ana SDE in VS Code and IntelliJ asks before it edits a file or runs a command.
Learn more →Security program
The controls behind the report.
What our compliance program covers day to day. Details and evidence are in our reports, available under NDA.
- ✓
Change management
Every production change is tracked, peer-reviewed in code review and released through a controlled process.
- ✓
Access reviews
User access is reviewed every quarter, with corrective actions tracked to closure.
- ✓
Patch management
A documented patch policy covers cloud servers and endpoint devices, with monthly compliance reporting.
- ✓
Monitoring
Alerting, capacity reporting and regular management reviews of operational and security signals.
- ✓
Business continuity
Business continuity and disaster recovery plans are tested every year.
- ✓
Asset & software inventory
A maintained register of assets and software licenses.
- ✓
Secure development
SBOM generation and security review are part of the development lifecycle.
- ✓
Identity
SAML single sign-on and role-based access for the Ana platform.
FAQ
Security questions, answered.
Yes. OpenAna is SOC 2 Type II compliant. The report is available to customers and prospects under NDA - request it through the button on this page.
Security review
Bring your questionnaire.
We’ll share our SOC 2 Type II report and ISO 27001 certificate under NDA and walk your security team through deployment, data handling and guardrails.