Try for freeBook a demo
Open the trust center

Security at Oximy

Review the evidence, define your data boundary, and evaluate Oximy against your security requirements.

SOC 2 Type IIHIPAAGDPR
On this page

SOC 2 Type II

Review the report's scope and reporting period against your requirements.

Report coverage and reporting period
Systems and services in scope
Exceptions and complementary customer controls

Access and audit logs

Map access requirements to the people and systems in your scope.

Identity lifecycleReview authentication requirements, single sign-on, provisioning, and how access is removed when a person leaves.
PermissionsDefine the roles, team boundaries, and administrative access your review must cover.
Audit evidenceRequest the administrative events, policy changes, export paths, and retention details relevant to your review.

Deployment

Bring your infrastructure requirements into the scope discussion.

Deployment options

Managed cloud

Oximy operates the service. Your workspace stays isolated from other customers.

Fully on-premise

Oximy runs inside your environment, with your keys, identity provider, and retention.

Location and residencySpecify permitted regions, processing locations, and any customer-cloud or on-premise requirement.
Network and isolationReview network paths, tenant isolation, private connectivity requirements, and the responsibilities on each side.
Source permissionsAgree the systems, access method, permissions, and records involved in each proposed connection.

Data handling

Agreed sourcesAI usage and cost, alongside records of the business work.
Customer controlsDefine what is captured, retained, and redacted.
Scoped evidenceReview the work and its observed results within that boundary.

Agree the source-level boundary during review: the fields and identifiers needed, whether content is involved, and what the source makes available. Include redaction and retention requirements in that scope.

Security operations

Use the review to cover testing, response, and operational access.

Testing and remediationRequest penetration-test scope, vulnerability-management practices, and the treatment of findings.
Incident responseReview investigation, containment, customer notification, and recovery procedures.
Production accessExamine access approval, logging, periodic review, and removal procedures.
People and policyReview relevant security policies, employee responsibilities, and training materials.

Review materials

Use the trust center and the review conversation to request the materials relevant to your scope.

Open the trust centerEmail support@oximy.com

Report a security issue

Contact Oximy with the affected area and a description of the issue.

Contact Oximy

Bring your security review
and your AI policy.

See how Oximy applies your rules on a device, and what stays on the device.

Try for freeBook a demo

Windows macOS Linux