Infrastructure & Hosting
Oslys infrastructure runs on hardened Linux containers orchestrated via micro-services architecture. Every node operates under a zero-trust model with mandatory hardware-backed MFA. Communications are TLS 1.3 end-to-end with strict CSP and HSTS headers enforced at the edge.
All source code, client artefacts, and internal tooling reside in encrypted repositories. Access is audited, time-bound, and scoped to the principle of least privilege. Build pipelines run in ephemeral containers with no persistent credentials.
Data Handling & Backups
Client data is encrypted at rest using AES-256 and in transit via TLS 1.3. Encrypted backups are taken daily with off-site replication, retention policies aligned to engagement SLAs, and purge schedules enforced automatically. No client data leaves its designated region without explicit authorisation.
Secrets are managed through zero-knowledge vaulting with hardware-backed encryption. Credentials are never hardcoded, never committed, and never shared over unauthenticated channels. Logs are immutable and retained in append-only storage with strict access controls.
Communications & Email Security
Email is secured with MTA-STS, TLS-RPT, DKIM, DMARC (p=reject), and SPF. Inbound and outbound channels are authenticated, monitored, and logged. We maintain a published security.txt and operate a dedicated vulnerability disclosure inbox at security@oslys.com.
All internal and client-facing communications are conducted over encrypted channels. Video calls, document sharing, and code reviews happen inside audited, access-controlled environments. No sensitive information is ever transmitted over unencrypted channels.
Operational Security & Development
We adhere to an Agile development framework with security embedded at every sprint. Code is reviewed, dependencies are scanned, and containers are built from minimal base images with no extraneous surface area. CI/CD pipelines enforce signing, provenance attestation, and vulnerability gates before any artefact reaches production.
We actively evaluate and adopt emerging open-source methodologies including BMAD (Behavioural Model for Agentic Defence), agentic harness patterns, and reproducible-build tooling. Our engineering baseline is defence-in-depth — not because we are audited, but because that is the only standard we recognise.
Vulnerability Disclosure
We maintain a public disclosure policy for security researchers. If you identify a vulnerability in our systems, we encourage responsible disclosure via security@oslys.com. We commit to acknowledging receipt within 24 hours and providing a full assessment within 5 business days.
Our /.well-known/security.txt file is published at the standardised location with canonical contact information, disclosure terms, and encryption keys. We do not offer bug bounties at this stage but extend public recognition for validated reports, per the researcher's preference.