No fake completeness
Missing data is shown honestly. No invented 100% metrics.
Trust & security
How isops.ai handles truth, evidence, and AI.
What the product stores, how evidence works, and how AI behavior is controlled.
Truthful state
Posture, evidence, and maturity shown separately. No invented scores.
AWS-native
Workflows around posture, remediation, controls, evidence, and exports.
Provider-aware AI
Copilot is live when configured, explicitly marked otherwise.
Trust principles built into the product.
Evidence follows remediation
Reports reflect real action history — not manually stitched narratives.
AI is explicit, not magical
Configured providers enable generation. Unconfigured states are shown directly.
What a buyer or auditor can validate
- Read-only AWS access. The scan role is the AWS-managed SecurityAudit policy plus scoped Get* / List* / Describe* — no write action anywhere in the policy. Two paths write, and you enable both: a remediation you approve, and the optional scheduled-scan stack, which stores reports in your own S3 bucket and publishes to your own SNS topic.
- Remediation cannot become a shell. Drafted commands are parsed into an argument vector and executed with shell=False; only aws invocations are accepted, shell metacharacters and command substitution are rejected outright, execution requires an admin role plus an explicit per-action confirmation, and every run is written to the audit log with the actor.
- Authentication fails closed. Every API route requires a session or API key unless it appears on a small, explicit public allowlist — new routes are private by default rather than opt-in.
- Tenant isolation is enforced centrally. Org scoping is applied at the data-access layer by session-level events, not by each query remembering to filter, so a route cannot forget it.
- Questionnaire answers call no model. They are assembled from your own approved policies, Statement of Applicability and evidence by deterministic retrieval — so an answer cannot be invented.
- How scan-backed posture is distinguished from compliance-program maturity.
- How remediation, risk linkage, and evidence are stored with audit trail.
- How exported reports preserve partial states instead of hiding them.
- How the copilot fits controlled workflows across findings, risks, CAPA, and evidence.
AI & data handling
- AI generation depends on explicitly configured provider credentials.
- Unconfigured AI surfaces show a truthful configuration-required state.
- Evidence and guidance surface where operators act — not in a separate silo.
- Trust reviews can start from exported artifacts and move into the live system.
Request a buyer walkthrough
Bring one backlog, one environment, or one audit pain point. We show the workflow live.
Executive
Operator
Security
Reporting a vulnerability
Email security@isops.ai. Please include what you found, the steps to reproduce it, and how you judge the impact. Our security.txt lists the same address.
In scope: this website, and the isops.ai application as distributed. Because the product is self-hosted, a finding in someone else's deployment belongs to whoever runs it — tell us and we will fix the shipped software, but we cannot act on their instance.
Please do not: test against an account or deployment that is not yours, run denial-of-service or load tests, or use social engineering or physical attacks to reach a system.
We will acknowledge your report and tell you what we intend to do about it. We do not currently run a paid bounty programme, and we will not take legal action over research conducted within the scope above and reported privately.
Need a security questionnaire first?
Email the scope of your review. We coordinate trust review and route follow-ups.
contact@isops.ai
Vulnerability reports: security@isops.ai
Continue with the product.
See the full product, workflow model, and report outputs — or book a security-focused walkthrough.