OpenObserve
Get DemoStar
Mobile View Menu

Enterprise-Grade Security & Compliance

OpenObserve delivers secure, scalable observability with encryption, RBAC, SSO, and comprehensive audit controls—built for the most demanding enterprise environments.

Table of Contents

Overview

OpenObserve is a lightweight, highly scalable observability platform built for secure, petabyte-scale logs, metrics, and traces. Security is embedded in our architecture and day-to-day operations, enabling you to adopt OpenObserve with confidence in regulated and enterprise environments.

Our Security Commitment

At OpenObserve, we prioritize security at every level of our platform. From secure-by-default configurations to enterprise-grade compliance certifications, we ensure your observability data remains protected while maintaining the performance and scalability you need.

Supported Projects & Versions

OpenObserve consists of multiple distributions:

  • OpenObserve (OSS): The open-source core available in our GitHub repository
  • OpenObserve Enterprise: Commercial features built on top of the open-source foundation
  • OpenObserve Cloud: Our fully-managed hosted service

We provide security fixes for the current stable release. Pre-release builds (main branch, release candidates) are supported on a best-effort basis.

Security Architecture

Zero Trust Architecture

OpenObserve implements zero trust principles through:

  • Integration with leading zero trust providers like Cloudflare
  • Continuous verification of all users and devices
  • Microsegmentation of network resources
  • Context-aware access policies
  • No implicit trust based on network location

Encryption in Transit

  • TLS 1.2+ encryption for all client-to-API communications
  • Secure service-to-service traffic with mutual TLS support
  • Certificate pinning available for enhanced security

Encryption at Rest

  • Full encryption support at the storage layer
  • Integration with cloud KMS services (AWS KMS, Azure Key Vault, GCP KMS)
  • Encrypted backups and snapshots

Data Minimization

  • Optional redaction pipelines to remove sensitive fields before indexing
  • Configurable data retention policies with automatic deletion

Access Control & Identity Management

Authentication

  • API tokens and keys for secure ingestion and query operations
  • Per-organization scoping for multi-tenant environments
  • Token rotation policies with configurable expiration

Authorization

  • Role-Based Access Control (RBAC) for granular permissions
  • User, team, and token-level access management
  • Least privilege principle enforcement

Single Sign-On (SSO)

  • SAML 2.0 support for enterprise identity providers
  • OpenID Connect (OIDC) integration
  • OAuth 2.0 authentication flows
  • Support for major identity providers including:
    • LDAP and Active Directory
    • GitHub, GitLab, Google
    • LinkedIn, Microsoft
    • Okta, Auth0, Keycloak
    • Any SAML 2.0 or OIDC-compliant provider

Multi-Tenancy & Isolation

  • Logical separation through organizations and streams
  • Resource quotas and rate limiting per tenant
  • Network-level isolation options for strict compliance requirements
  • Dedicated infrastructure options for enterprise customers
  • Complete environment isolation with separate AWS accounts for:
    • Development environments
    • Staging environments
    • Production systems
    • Audit and compliance logs
    • Log storage and archival

High Availability & Resilience

Infrastructure Architecture

  • Multi-AZ Deployment: Production services distributed across multiple availability zones
  • Auto-scaling: Automatic capacity adjustment based on load patterns
  • Load Balancing: Redundant load balancers with health checks and automatic failover
  • No Single Points of Failure: All critical components deployed in N+1 configuration

Data Durability & Backup

  • Point-in-time Recovery: Continuous backups with configurable retention
  • 99.999999999% (11 9's) Durability: Leveraging S3 for object storage

Disaster Recovery

  • RTO (Recovery Time Objective): 4 hours for critical services
  • RPO (Recovery Point Objective): 1 hour maximum data loss
  • Automated Failover: Zero-downtime failover for stateless services

Service Availability

  • 99.9% Uptime SLA: For OpenObserve Cloud production workloads
  • Planned Maintenance Windows: Communicated 7 days in advance
  • Zero-downtime Deployments: Rolling deployment strategy

Monitoring & Observability

  • Real-time monitoring: Sub-minute alerting for service degradation
  • Custom dashboards: Service health visibility for customers

Network Resilience

  • DDoS Protection: Multi-layer DDoS mitigation at network edge
  • CDN integration: Global content delivery network for static assets
  • Network Path Diversity: Multiple upstream providers and peering arrangements
  • Edge Locations: Distributed points of presence for reduced latency

Compliance & Trust

SOC 2 Type II (Certified)

OpenObserve has achieved SOC 2 Type II certification, demonstrating our commitment to:

  • Access control and user management
  • Change management procedures
  • System monitoring and alerting
  • Incident response protocols
  • Data protection measures

Framework Alignment

Our security controls map to common compliance frameworks:

  • NIST Cybersecurity Framework
  • CIS Controls
  • HIPAA Security Rule (for healthcare customers)
  • GDPR requirements (for EU data protection)

Personnel Security

Background Verification

  • Comprehensive background checks for all employees (where legally permitted)
  • Reference verification and employment history validation
  • Ongoing monitoring for security-sensitive roles

Security Training

  • Mandatory security and privacy training during onboarding
  • Annual refresher training for all team members
  • Role-specific security training for:
    • Engineers: Secure coding practices and vulnerability management
    • Operations: Incident response and system hardening
    • Support: Data handling and customer privacy

Access Management

  • Principle of least privilege
  • Regular access reviews
  • MFA requirement for all employees

Physical Security

Cloud Infrastructure Security

OpenObserve Cloud leverages the physical security controls provided by leading cloud service providers (CSPs) including AWS, Azure, and GCP. These providers maintain comprehensive physical security measures that meet or exceed industry standards.

CSP-Provided Security Controls

Our cloud infrastructure benefits from:

  • AWS: SOC 1/2/3, ISO 27001/27017/27018 certified data centers
  • Azure: ISO 27001, HIPAA, FedRAMP certified facilities
  • GCP: ISO 27001, SOC 2/3, PCI DSS compliant data centers

Data Center Security Features

Through our CSP partnerships, we inherit enterprise-grade physical security:

  • 24/7 security personnel and video surveillance
  • Biometric and multi-factor access controls
  • Mantrap entry systems and security checkpoints
  • Regular third-party security audits and certifications
  • Compliance with regional and industry-specific standards

Environmental Controls

CSP data centers provide:

  • Redundant power systems with backup generators
  • Climate control with N+1 HVAC systems
  • Fire detection and suppression systems
  • Water leak detection and flood prevention
  • Seismic bracing in earthquake-prone regions

Media Security

  • Secure media destruction following NIST 800-88 guidelines
  • Encrypted storage devices by default
  • CSP-managed decommissioning with certificates of destruction
  • No physical media access in cloud environments

Compliance Inheritance

By leveraging CSP infrastructure, OpenObserve Cloud customers automatically benefit from:

  • Regular compliance audits (SOC 2, ISO 27001, PCI DSS)
  • Physical security controls that meet regulatory requirements
  • Transparent security practices through CSP compliance reports
  • Continuous improvements in physical security measures

Self-Hosted Deployments

  • For self-hosted OpenObserve deployments, physical security is the responsibility of the customer and should align with organizational security policies and compliance requirements.

Platform Security Features

Audit Logging

  • Comprehensive audit trails for all administrative actions
  • User access events and API usage tracking
  • Immutable log storage for 365 days with tamper detection
  • Integration with external SIEM systems

Configuration Management

  • Version control for all configuration changes
  • Change approval workflows
  • Automated configuration compliance scanning
  • Infrastructure as Code (IaC) for reproducible deployments

Rate Limiting & DoS Protection

  • Configurable rate limits per API endpoint
  • Automatic throttling for suspicious activity
  • DDoS mitigation at network edge
  • Resource quotas to prevent abuse

Privacy & Data Governance

Data Retention

  • Configurable retention policies per stream or index
  • Automated data deletion on schedule
  • Compliance with data minimization principles
  • Backup retention separate from primary data

Data Residency

  • Self-hosted: Complete control over data location
  • Cloud hosted:
    • US regions: Ohio (us-east-2)
    • EU regions: Coming soon
    • APAC regions: Coming soon

Right to Erasure

  • Support for GDPR Article 17 compliance
  • Granular deletion by organization or stream
  • Documented procedures for data removal
  • Verification of deletion completion

Secure Development Lifecycle

Code Security

  • Mandatory code reviews for all changes
  • Static application security testing (SAST)
  • Software composition analysis for dependencies

Vulnerability Management

  • Regular security patching schedule
  • CVE tracking and prioritization
  • Responsible disclosure program
  • Security advisory notifications

Build & Supply Chain Security

  • Reproducible builds with pinned dependencies and build tools
  • Version pinning for all dependencies to ensure deterministic builds
  • Software Bill of Materials (SBOM) available in our GitHub repository for all supported releases
  • Use of distroless containers to minimize attack surface
  • Public verification through GitHub Actions logs - all release builds are publicly auditable

Security Updates

  • Proactive dependency updates and security fixes in patch releases
  • Security-relevant changes highlighted in release notes
  • Security advisories published via GitHub (GHSA) and CVE databases
  • Critical patches deployed within 48 hours of disclosure

Testing & Quality Assurance

  • Automated security testing in CI/CD
  • Automated monthly penetration testing

Incident Response

Response Process

  1. Detection: 24/7 monitoring and alerting by our internal security team
  2. Triage: Severity assessment and escalation
  3. Containment: Immediate threat mitigation
  4. Investigation: Root cause analysis
  5. Remediation: Fix implementation and validation
  6. Communication: Customer notification per SLAs
  7. Post-mortem: Lessons learned and process improvement

Communication

  • Security incident notifications within 24 hours
  • Regular status updates during active incidents
  • Detailed post-incident reports
  • Transparent security advisories

Shared Responsibility Model

OpenObserve Provides:

  • Secure software with security-by-default configurations
  • Authentication and authorization frameworks
  • Encryption capabilities and key management interfaces
  • Audit logging and monitoring capabilities
  • Security patches and updates
  • Compliance certifications and attestations

Customer Responsibilities:

  • Identity and access management configuration
  • Network security (VPC, firewalls, WAF)
  • Secret and credential management
  • Data classification and retention policies
  • Endpoint security for client systems
  • Monitoring and responding to security events

Security Best Practices Checklist

  • Initial Setup
  • Access Management
  • Data Protection
  • Monitoring & Compliance

Vulnerability Disclosure

Reporting Security Issues

We encourage responsible disclosure of security vulnerabilities. Please report issues through one of these channels:

  1. GitHub Security Advisory (Preferred)
    • Navigate to our GitHub repository
    • Go to Security → "Report a vulnerability"
    • Submit a private advisory
  2. Email: security@openobserve.ai
    • Use PGP encryption if available
    • Include "SECURITY" in the subject line

What to Include in Reports

  • Clear description of the vulnerability and its impact
  • Affected components (repository, package, service)
  • Version numbers and environment details
  • Reproducible steps or proof of concept (non-destructive)
  • CVSS v3.1 score estimation (if available)
  • Any relevant logs, screenshots, or traces

Vulnerability Scope

In Scope

  • Remote code execution, injection, authentication/authorization bypass, data exposure
  • Logic flaws causing privilege escalation or data integrity issues
  • Supply chain risks in our build/release artifacts
  • Default configuration issues that materially reduce security
  • OpenObserve Cloud issues (tenant isolation, API auth, data access)

Out of Scope

  • Vulnerabilities requiring physical access or stolen credentials
  • Denial of service from volumetric attacks without a product flaw
  • Best-practice recommendations without a concrete vulnerability
  • Issues only affecting unsupported/End-of-Life versions
  • Vulnerabilities in third-party dependencies with no exploitable impact in OpenObserve's usage (we'll upstream where appropriate)

Responsible Testing Guidelines

  • Use test or your own accounts/data only; avoid accessing others' data
  • Avoid actions that degrade service for other users (no volumetric/DoS)
  • Limit testing on OpenObserve Cloud to non-production accounts and data
  • Do not run automated scanners against OpenObserve Cloud without prior coordination
  • Respect rate limits and legal boundaries in your jurisdiction
  • If you discover sensitive data exposure, stop testing immediately and report privately

Coordinated Disclosure

We request a 90-day disclosure window by default. We may extend this for complex fixes or cross-vendor coordination. We publish advisories via GitHub Security Advisories (GHSA) and CVE where applicable, crediting reporters who wish to be named.

Safe Harbor

We support good-faith research. If you:

  • Follow this policy
  • Avoid privacy violations, data destruction, and service disruption
  • Report vulnerabilities promptly and do not abuse them

We will not pursue or support legal action against you. This safe harbor does not cover unlawful actions, uncoordinated testing on production systems, or use of data beyond what's necessary to demonstrate the issue.

Recognition

  • Credit in security advisories (with permission)
  • Inclusion in our security hall of fame
  • Thank you swag for significant findings

Bug Bounty Program

At this time, we do not operate a public bug bounty program. We are grateful for responsible disclosures and, with your consent, will credit you in release notes or advisories. From time to time we may offer thank-you swag. If a bounty program is introduced in the future, we will update this policy accordingly.

Reporting Fraud & Abuse

When to Report:

Please report the following types of incidents immediately:

  • Phishing attempts using OpenObserve branding
  • Unauthorized use of OpenObserve accounts or infrastructure
  • Suspicious activity on OpenObserve Cloud affecting your organization
  • Copyright or trademark infringement
  • Abuse of OpenObserve services for malicious purposes
  • Spam or harassment originating from OpenObserve systems
  • Account abuse or suspicious activity affecting OpenObserve Cloud

How to Report

  • Email: abuse@openobserve.ai
  • For active incidents: Include "URGENT" in the subject line
  • For OpenObserve Cloud: Include affected organization ID and timestamps

What to Include

  • Description of the fraudulent or abusive activity
  • Screenshots or evidence of the abuse
  • Timestamps and relevant URLs
  • Account information if known
  • Any communications received

Our Response

  • Initial acknowledgment: Within 24 hours
  • Investigation: We will investigate all credible reports
  • Action: Appropriate measures including account suspension, legal action, or law enforcement referral
  • Follow-up: Status updates for the reporter when possible

Zero Tolerance Policy

  • OpenObserve maintains a zero-tolerance policy for:
  • Use of our platform for illegal activities
  • Attempts to compromise other users' data
  • Distribution of malware or malicious code
  • Violation of our Terms of Service or Acceptable Use Policy

Security Contacts

Additional Resources

Last Updated: August 2025

OpenObserve is committed to maintaining the highest standards of security and compliance. This document is regularly updated to reflect our current security posture and practices.

FAQs