← Back to Resources

Security Governance Datasheet

Who can act, what they can touch, and the evidence that the controls held. Path-based RBAC, vault custody of secrets, a hash-chained tamper-evident ledger that now records the origin of every action, a signed and verifiable supply chain, and secure-development practice attested against OWASP and ISO/IEC 27001 Annex A on every release.

Key Highlights

  • ✓Path-based RBAC & per-identity policy - explicit authorisation on every request, per path and identity.
  • ✓OIDC and LDAP identity providers plus local accounts, managed sessions, and step-up authentication for sensitive operations.
  • ✓Vault custody of secrets - built-in or your own - never inlined into automation, masked in every log.
  • ✓Hash-chained, tamper-evident evidence ledger with legal hold - carrying the origin of every action: proxy-aware client address, user agent, the acting session or token, the request id; principal ids, never names.
  • ✓Access-review campaigns on a cadence and an exceptions register - attestations recorded, revokes opening tracked work items, every waiver scoped and visible.
  • ✓A signed supply chain - Developer ID and notarised on macOS, Authenticode on Windows, cosign-sealed checksums under a pinned key; the release keyring trusts production keys only.
  • ✓Secure development attested, honestly - OWASP and ISO/IEC 27001 Annex A controls checked by tooling on every release train; tool-assisted attestation, not certification.
  • ✓Disclosed installation intelligence on the free tier only - a coarse platform profile, no hostname, MAC or serial, under a published privacy notice; paid tiers send identifiers only.

Security governance in OpsChain means one enforcement point and one tamper-evident history: authorisation enforced on every request, secrets in vault custody, and the evidence lane your reviews — and your regulator conversations — draw from. That lane now records the origin of every action, the platform you install is itself signed and verifiable, and its secure-development practice is attested on every release.

This datasheet covers the mechanisms (RBAC, identity, step-up, vault custody, the evidence ledger with the proxy-aware client address, user agent and acting credential on every event, review campaigns, the exceptions register, estate metadata in your regulatory vocabulary), the signed supply chain and how to verify a download, the attestation posture against OWASP and ISO/IEC 27001 Annex A — tool-assisted, never certification — and the free tier's disclosed installation intelligence under its privacy notice.

What you can verify

  • opschain events list --type api:auth:login -o json: the newest event's data.actor carries the client address, user agent and session id — never a name.
  • A forwarded-for header from an unlisted peer is ignored; the peer's address is recorded.
  • codesign -dv on the macOS binary shows Developer ID Application: LimePoint Pty Ltd (5VMU6KAJU2).

Download Security Governance Datasheet

Fill in the form below to access this resource.