Protection & Security
entityOS runs a formal, externally-certified Information Security Management System covering the confidentiality, integrity and availability of every entity’s data on the entityOS.cloud service.
Protection isn’t a single control — it’s a set of philosophies applied together, from the foundation up.
One protocol (HTTPS), two ports (80/443), all traffic encrypted with 256/2048-bit SSL. A smaller surface is an easier surface to defend.
The UI/view-controller (“user mode”) is separated from the model (“kernel mode”), so each zone runs under its own security regime and validates traffic in and out.
We build on Amazon Web Services and leverage their investment in a robust, compliant, globally-audited infrastructure layer.
Every space owner sets functional and data-level access. Each of the 700+ platform methods can be pre-set by in-model role — including 2nd-factor authentication.
Layering and the Law of Demeter: people and systems only need to know about their own layer. Humans are the key weakness, so we run the minimum required.
We work with partners and constantly try to break our own system. A dedicated service tests the live endpoints around the clock.
Whatever the form of the information, and however it is shared, used, communicated or stored — these three properties are always preserved.
Data is disclosed only to those with a reason to know. Access is role-based, least-privilege and encrypted at rest and in transit.
Data is protected from unauthorised change — with optional cryptographic signatures and blockchain-anchored hashes for high-value records.
A real-time duplicate runs in warm mode, daily test-restores are performed, and the operating model is designed to survive disruption.
No single layer carries the load. Each builds on the one beneath it, from the AWS foundation to certified governance.
World-class, independently-certified infrastructure — physical, network and environmental security inherited from Amazon Web Services (Sydney by default).
A fixed, hardened model layer developed over 25+ years. It changes rarely, so the attack surface stays small and well-understood.
All application change happens in the isolated “user mode” on top of the platform — UI code can never affect tenant data isolation.
Role-based functional and data access on every method, TOTP/MFA, perfect forward secrecy, and encryption at rest and in transit.
A dedicated service probes the live endpoints around the clock; exceptions raise real-time alerts to operations.
A plan-do-check-act ISMS, externally audited and certified to ISO 27001/17 — with the testing evidence forming part of the audit.
Each area below is documented in full. Start with the ISMS, or jump to compliance, testing, certificates and more.
The formal ISMS — purpose, scope, objectives and principles — built around ISO 27001 and 27017.
ExploreAWS & platform compliance, ISO 27001/17, COBIT alignment, the Statement of Applicability, risk management and ACSC Essential 8.
ExploreEvery ISO/IEC 27001:2022 Annex A control and the ISO/IEC 27017:2026 cloud controls — our applicability decision and how each is implemented.
ExploreHow our ISO 27001/27017-certified controls map to the AICPA SOC 2 Trust Services Criteria — for customers who assess vendors against SOC 2.
ExploreOur ISO 27001/27017-certified controls mapped across all six NIST Cybersecurity Framework 2.0 Functions.
ExploreOur ISO 27001-certified controls mapped to the ASD/ACSC Essential Eight mitigation strategies and maturity model.
ExploreOWASP-based testing and a dedicated real-time service that continuously probes the live endpoints and alerts operations on any exception.
ExploreISO/IEC 27001:2013 and ISO/IEC 27017:2015 — externally assessed and certified by Best Practice Certification (JAS-ANZ accredited).
ExploreA director’s attestation of continued conformance during the current ISO 27001/17 recertification — with a signed PDF.
ReadAt-rest protection, hashing and encryption helpers, and immutable off/on-chain integrity for high-value data.
ExploreHow the “least number of humans” design protects the availability of the service against biological threats such as viral disease.
ExplorePublic incident notifications for the entityOS.cloud service.
ViewResponsible disclosure — report an issue and be rewarded for making the community safer.
View