Security architecture
OnyxOne is built on a conventional, dependable stack: hosted and delivered on Vercel, with data, authentication and storage on Supabase, and screening or data providers configured per deployment. The design principle is simple — sensitive material stays on the server, and the client is treated as untrusted.
Your browser only ever receives a public key. Secrets and services run server-side. Screening and data providers are configured per deployment.
Platform controls
- Server-side secrets only; the service-role database key and other secrets never reach the browser, which only ever receives a public key.
- Role-based access control with segregation of duties, and signed, httpOnly, tamper-evident sessions.
- Encryption in transit and at rest, with session and device controls on every account.
- Hardened HTTP security headers — HSTS, frame-ancestors none (anti-clickjacking), nosniff, and strict referrer and permissions policies.
- Fail-safe integrations — capabilities that aren't configured refuse rather than fail open; errors return safe envelopes with no internal detail leaked.
- An immutable audit trail of actions, decisions and changes across the platform.
How the audit trail works
Every screening result, case decision, override and policy change is written to an append-only record that is timestamped and attributed to a user — so how a decision was made is captured as you work, ready for internal and external audit.
An append-only record of every action and decision, ready for internal review, external audit and regulators.
Data handling
We collect the minimum needed to run the platform, and data is retained only as long as the customer's instructions and the law require, then deleted or anonymised. Data residency is configurable to the customer's obligations. Full detail is in our Privacy Policy and Data Processing Agreement.
Incident management
Security events are triaged on a documented process: detect and record, assess severity and scope, contain, remediate, then review. Where an incident involves a customer's personal data, we notify the customer without undue delay after becoming aware of it, with the information they need to meet their own notification duties — the commitment set out in section 6 of our Data Processing Agreement. Incidents are logged with a timeline and a post-incident review; customers can request the report for an incident affecting their data.
Resilience, continuity & recovery
The platform runs on managed infrastructure — Vercel for application hosting and edge delivery, Supabase for database, authentication and storage — and inherits the redundancy, backup and regional failover those providers operate. Application state is held in the managed database rather than on application instances, so instances are replaceable and recovery does not depend on any single machine.
We publish this honestly: a formally documented and independently tested business-continuity and disaster-recovery programme, with contractually committed RTO and RPO targets, is a roadmap item and is not yet in place. Customers requiring committed recovery objectives should raise them during contracting so they can be agreed explicitly rather than assumed.
Vendor & sub-processor management
Infrastructure sub-processors are named and published in our Privacy Policy and Trust Center rather than left generic. Each is bound to data-protection obligations no less protective than our own DPA, and we remain liable to the customer for their performance. Screening, identity and data providers are contracted and configured per deployment — they are the customer's chosen providers, disclosed for that deployment rather than presented as a fixed partnership. We give notice of intended sub-processor changes and a chance to object, as set out in section 5 of the DPA.
Supporting your audits and regulatory examinations
The platform is designed so that evidence is a by-product of doing the work. Auditors and examiners can be given scoped, read-only access to a control, its test history, the evidence attached to it and the full decision trail behind it — including approvals, overrides and policy versions. Records can be exported for an examination pack. Section 7 of our DPA sets out the information and audit rights available to customers in respect of our processing.
Certifications & roadmap
We build to recognised security standards. SOC 2 and ISO 27001 are on our roadmap and are not yet held — we will publish attestations here once they are complete rather than claim them in advance. We do not display certification logos or badges for standards we have not achieved.
Reporting a vulnerability
Found a vulnerability? See our Responsible Disclosure policy and report it responsibly. We don't pursue legal action against good-faith researchers who follow it.