Optidata operates
- The data center infrastructure and the hardware
- The cloud platform: compute, storage and network
- Monitoring of the platform by the SOC and NOC
- On Private Cloud, the managed services in your contract
In short
The answers a security review asks for first.
Each line is detailed further down this page or on a page of its own, with what it covers and what it does not.
- SOC 2 Type II report
- Security, Availability and Confidentiality. 88 controls, a 90-day observation window, shared under NDA.
- ISO/IEC 27001
- Held by Optidata in its own name.
- SOC and NOC, 24/7/365
- People on shift every day of the year, not only alerts in a queue.
- Self-serve in Miami (US1)
- The console has one region, in Florida, United States.
- Private Cloud in Brazil and the US
- Three regions in Brazil and two in the United States.
- Vulnerability reports
- [email protected], also published in security.txt.
Who holds what
Two credentials in our name. The rest belong to the data centers.
A security review needs to know who was audited. Optidata holds the SOC 2 Type II report and ISO/IEC 27001. The data center facilities the infrastructure runs in hold credentials of their own, which describe those buildings and their operators, not Optidata's controls.
| Credential | Held by | What it covers |
|---|---|---|
| SOC 2 Type II report | Optidata | Independent examination of Optidata's controls for Security, Availability and Confidentiality over an observation window. |
| ISO/IEC 27001 | Optidata | The information security management system: risk assessment, controls in scope, owners and the review cycle. |
| SOC 2 Type II and ISO/IEC 27001 | Data center facilities | The facilities hold these two as well, in their own name and with their own audits. |
| SOC 1 Type II | Data center facilities | Controls relevant to their customers' financial reporting. |
| ISO/IEC 27701 | Data center facilities | Privacy information management, an extension of ISO/IEC 27001. |
| ISO 22301 | Data center facilities | Business continuity management. |
| ISO 9001 | Data center facilities | Quality management. |
| PCI DSS compliance | Data center facilities | The payment card data security standard, applied to the facility environment. |
| Tier III Design and Tier III Facility | Data center facilities | Uptime Institute ratings of the facility design and of the built site. |
Optidata does not hold PCI DSS, SOC 1, ISO 9001, ISO 22301, ISO/IEC 27701 or Tier ratings in its own name.
Security operations
How security is run, day to day.
What applies to every customer, and what Private Cloud adds on top of it.
SOC and NOC, 24/7/365
A staffed Security Operations Center and Network Operations Center: threat analysis, incident triage and response, with people on shift. Average first response under 8 minutes.
Pentests on a calendar (Private Cloud)
Internal pentests every quarter, external every six months. Reports available under NDA for your security team.
Vulnerability reviews (Private Cloud)
Continuous scanning plus a formal review every 90 days, with findings, remediation dates and sign-off.
DDoS protection
On by default in every Private Cloud region. On the self-serve platform, Anti-DDoS is an option you enable per instance.
WAF and Zero Trust (Private Cloud)
A managed Web Application Firewall, plus identity-based access per application with VPN and ZTNA.
Network controls you define (self-serve)
VPC networks, security groups and SSH keys in the console decide who reaches each server.
Data location
Where your data runs, by product.
Self-serve has one region. Private Cloud has five. Data residency in Brazil exists only on Private Cloud.
| Product | Where it runs | Data stays in Brazil |
|---|---|---|
| Self-serve platform: Cloud Compute, GPU, Managed Containers (K8s), Managed Databases, storage and networking | Miami (US1), United States | No |
| Private Cloud, Brazilian regions | OPD-BR1, OPD-BR2 and OPD-BR3-IA, Brazil | Yes |
| Private Cloud, US regions | OPD-US1 and OPD-US2, United States | No |
Responsible disclosure
Found a vulnerability? Tell us first.
Email [email protected] with the affected service or URL, the steps to reproduce and the impact you observed. You can write in English, Portuguese or Spanish.
Please give us reasonable time to fix the issue before sharing details publicly. Do not access, change or delete data that is not yours, and do not run tests that degrade the service for other customers, such as denial of service.
Security contact
Go deeper
One page per question.
SOC 2 Type II report
What the report covers, the observation window, what it is not, and how to request it under NDA.
Read about the reportLGPD and data residency
What stays in Brazil, what runs in Miami, LGPD roles and how to request a DPA.
Read about LGPDRegions
Miami (US1) for self-serve, five Private Cloud regions in Brazil and the US, and what runs where.
See the regionsManaged SOC
Our SOC monitoring your own environment as a service: SIEM, XDR and threat intelligence.
See Managed SOCPrivacy notice
How Optidata handles the personal data it collects about customers and visitors.
Read the noticeTalk to the team
Security questionnaires, the SOC 2 report and ISO/IEC 27001 details, on request.
Contact usSecurity FAQ
Short answers for your security review.
Is Optidata SOC 2 compliant?
Optidata has a SOC 2 Type II report. An independent auditor examined its controls for Security, Availability and Confidentiality over a 90-day observation window. SOC 2 is an attestation report, not a certification, and the report is shared under NDA. See the SOC 2 page.
Does Optidata have ISO 27001?
Yes. Optidata holds ISO/IEC 27001 in its own name. Ask for the certificate details through the contact page.
Is Optidata PCI DSS certified?
Not in its own name. PCI DSS compliance belongs to the data center facilities the infrastructure runs in, as do SOC 1 Type II, ISO 9001, ISO 22301, ISO/IEC 27701 and the Tier III ratings.
Where is my data stored?
On the self-serve platform, in Miami (US1), United States. On Private Cloud, in the regions your architecture uses: OPD-BR1, OPD-BR2 or OPD-BR3-IA in Brazil, or OPD-US1 or OPD-US2 in the United States. See every region.
How do I report a security vulnerability?
Email [email protected] with the affected service, the steps to reproduce and the impact. The same contact is published in /.well-known/security.txt.
Does an audited provider make my workload secure?
No. The audits cover what Optidata runs and operates. Your access model, operating systems on self-serve servers, applications, keys and backups stay your responsibility.