Security

We assume the only thing that matters is this: the platform that monitors your infrastructure must not be the one that compromises it. The full posture lives in /docs#security; this page summarizes for procurement and security review.

Everything described as available below is enforced in code you can verify on your own hosts. Everything we do not have is listed, by name, in What we don't have yet. We hold no security certifications today and claim none.

Access controls

• Read-only by default. A newly installed collector can change nothing. Its allowed_action_templates list starts empty, so until you grant a specific template on a specific host, the agent can only report telemetry. There is no master "enable actions" switch.
• Per-action permissions, per host. Authorize service.restart on one node without authorizing gpu.reset anywhere. Grants are revocable instantly.
• Host fingerprint pinning. Hostname, CPU, RAM and architecture are pinned on the agent's first handshake. A runtime key stolen from one server will not authenticate from another, and the attempt is rejected and written to the audit log.
• Role-based access (owner, admin, operator, viewer), enforced in the API routes rather than hidden in the UI.
• Approval queue for high-risk actions, even in autonomous mode. Queued actions carry an expiry, so a stale approval cannot be executed later. Dual approval is on the roadmap.
• JWT access tokens with 1-hour expiry; opaque refresh tokens stored only as hashes.
• Identity is email and password. SSO is not available on any plan — see below.

Audit log

The audit log captures staff reads, not only writes. Every cross-tenant access by a Rognix staff member records actor, platform role, target, detail and source IP in the admin_audit table. Staff capability gating is centralised in one module rather than scattered through route handlers, and staff-only routes return 404 rather than 403, so they do not confirm their own existence to an unauthorized caller.

Your own activity is logged the same way: every dispatched action records actor (user, AI, scheduled, system), inputs, outputs, duration and outcome. The log is queryable through the API and visible at /app/activity. Export is not built yet — see below.

Encryption

• In transit: TLS 1.3 for all web, API, and agent traffic.
• At rest: AES-256-GCM for cloud credentials, with versioned keys so rotation does not require downtime.
• Passwords: argon2id (memory-hard).
• Agent keys, refresh tokens, bootstrap keys: stored as SHA-256 hashes only; plaintext is shown once at creation.
• Backups: AES-256 encrypted at rest on the primary host. See the backup position below for what is and is not replicated off that host.

Supply chain

Agent releases ship with an SBOM, cosign keyless signatures (Sigstore Fulcio) and SLSA provenance attestation, so you can verify that the binary on your host came from our build pipeline and from the commit we claim. The verification command is published with the release.

The agent self-updates from the control plane on a 6-hour interval and verifies the published SHA-256 checksum of the binary before swapping it in. If you do not want automatic updates, pin the version and manage upgrades yourself.

Deployment

Air-gapped self-hosted deployment is real and tested: a single-host control plane via Docker Compose with no internet egress, including a bring-your-own-LLM option. Metric data is never sent to a third-party model API in any deployment mode — the intelligence engine runs on the same infrastructure as the control plane.

Backups

Stated precisely, because this is the control we are currently weakest on:

• The database is dumped daily and encrypted with AES-256. The most recent dump is current.
• Those dumps are retained locally, on the primary host.
• Off-server replication is not operating. The upload target has been rejecting writes since 2 October 2026, so no backup has left the primary host since that date. We are replacing the destination.
• We do not describe our backups as cross-region, and have corrected earlier copy that did. The previous destination was in the same region as the primary host.

If an off-host backup guarantee is a requirement for your evaluation, ask us before you sign anything; we will tell you the current state rather than the intended one.

Operational

• Rate limiting on every API endpoint.
• Hardened systemd profile for the on-host agent (no privilege escalation, no kernel tunables, restricted writable paths).
• Actions execute argv-style with no shell, so command injection has no path in.
• Card details are handled by Stripe. We never see, store or transmit them.

What we don't have yet

As of 17 October 2026.

A company with no certifications and honest documentation is a company you can evaluate. These are the controls buyers ask us for that we do not have. Where there is no date, it is because we have not committed to one, and we would rather say so than invent a quarter.

• SSO (OIDC, SAML). On the roadmap Not available on any plan, including Enterprise. There is no identity-provider integration in the product; sign-in is email and password. On the roadmap, no committed date. Earlier versions of this page and our pricing listed SSO on Business and Enterprise. That was wrong and has been removed.
• SCIM provisioning. On the roadmap Not implemented. Users are invited and removed through the application or the API. On the roadmap, no committed date.
• Two-factor authentication. On the roadmap Not implemented for any account type, including ours. On the roadmap, no committed date.
• SOC 2. On the roadmap We are not SOC 2 certified, not SOC 2 Type 1 or Type 2, and no audit is currently engaged — there is no auditor, no engagement letter and no observation window running. A previous version of this page said an audit was in progress with a late-2026 target. It was not. SOC 2 is on the roadmap and we will publish a date when we have signed an auditor, not before.
• ISO 27001, FedRAMP, HIPAA, PCI DSS. On the roadmap None held, none in progress. We support security questionnaires and procurement review, which is not the same thing as holding a certification and we will not present it as such.
• Audit log export. On the roadmap The audit log is complete and queryable through the API, but there is no export endpoint or CSV download for it. The only CSV export in the product today is per-tenant usage for chargeback. On the roadmap, no committed date.
• Off-server backup replication. In development Daily encrypted dumps are running; replication off the primary host is not. See Backups above.
• Measured uptime and service credits. On the roadmap We do not publish a measured availability figure, and there is no automated uptime measurement or service-credit process behind one. Availability and support commitments are set contractually, per customer. If you need a specific availability figure, raise it in contracting and we will tell you what we can stand behind.

If you are evaluating us and a control on this list is a hard requirement, say so early. We would rather lose an evaluation on a gap we named than win one on a claim that does not survive diligence.

Vulnerability disclosure

Found something? We'd love to hear about it. Email security@rognix.com with details and steps to reproduce. We respond within 1 business day, fix critical issues within 7 days, and credit researchers in our security advisories (with permission).

Out of scope: anything that requires social engineering, physical access, or compromise of third-party services we don't control (Stripe, Resend, etc.).

security.txt

Contact: mailto:security@rognix.com
Expires: 2027-12-31T23:59:59Z
Preferred-Languages: en
Canonical: https://rognix.com/.well-known/security.txt
Policy: https://rognix.com/security