PostgreSQL

MongoDB

InfluxDB

Meeting modern data control expectations requires guarantees that the 
intended applications are exclusively the apps that can connect to your 
systems. Ockam moves trust to the application layer by building a mutually 
authenticated and encrypted communication channel between those systems.


App-to-app trust

Sharing secret keys across many apps and services increases the likelihood 
of secret keys leaking, in addition to eroding any guarantees that only 
intended apps can access sensitive data. Teams then layer in additional 
credential management approaches, network-level controls, and various other 
security approaches in an attempt to have a somewhat reliable assumption 
that only the intended app(s) were able to use the shared secret keys.

With Ockam, each app generates it's own _unique_ cryptographically provable 
identity and encryption keys, and uses those keys to establish trusted 
secure channels directly with other authorized apps as required.


No more shared secret keys

Whether it's reading a credential or secret value from a central source, 
or  transmitting a secret key to another app, every time a secret value is 
transmitted over the wire is another opportunity for it to leak. Ockam's 
approach to secret management means each secret key never needs to leave 
the place where it was generated. By removing the need to transmit secrets 
the risk of an attacker intercepting a secret in transit is also removed.


No more shipping secrets

Everyone hopes they never have a data breach, but to minimize the impact 
in case the worst happens Ockam apps automatically and regularly rotate 
their encryption keys. If a secret key is ever leaked the data at risk is 
reduced to the amount sent in the small window of that secret key was 
active. Don't put your historical and future data at risk because rotating 
secret keys is difficult&mdash; it's built-in from the start.


Automated & regular key-rotation

The approach to mutual authentication of every app that Ockam provides 
results in strong data governance guarantees around the authenticity and 
integrity of the data moving through your system. 


Data authenticity & integrity

Ockam's approach uses existing and well established open source
technologies and frameworks. We build trust through transparency so your 
CISO can be confident everything meets their requirements. The 
cryptographic and messaging protocols are 
[publicly documented](https://docs.ockam.io/reference/protocols) and
the implementations are 
[open source and available on GitHub](https://github.com/build-trust/ockam). 

We've published an independent third-party audit by
the security research firm [Trail of Bits](https://www.trailofbits.com), 
we've passed the security reviews of our major partners, and we're SOC2
compliant.

The [current status of our latest audits and compliance controls](https://audits.ockam.io) 
are also available.  


Trust your security team can depend on

Nobody loves running their own PKI. It's complicated, you still need to 
work out how to securely handle your root certificate and keys, have 
policies around  lifecycle management&hellip; a lot of extra 
infrastructure and orchestration.

With Ockam, each app generates keys and establishes trust directly there's 
no  need to run your own PKI systems.


No need to run Public Key Infrastructure (PKI)

Ockam can work with any language. You've the flexibility to write your 
applications in a mix of Java, Python, Go, Scala, you name it!


Any language

Ockam is agnostic to network-level and cloud-specific features. Whatever
cloud you're on, even if you're running a multi-cloud setup, Ockam is a 
single approach that will provide secure point-to-point wherever you need 
it.


Complete multi-cloud support

Ockam Orchestrator is a cloud-based fully managed solution that allows you 
to be successful within minutes. With SLA guarantees and publicly 
available historical uptime reporting, it's the preferred deployment 
approach for the majority of customers. For those with specific 
self-managed deployment requirements, Ockam Business Critical provides 
options for running entirely within your own VPC or on-prem.


Self-managed deployments

Manage access to any system with application-level controls

Keep .css-vykmad{color:var(--chakra-colors-brand-500);}private data private

Keep private data private