Built for the people who hold the keys
OpsNexus touches your pipelines, clouds and servers, so it is built to protect them. It runs on your network, keeps secrets in Vault and records every change.
Six layers between an attacker and your production
Sign-in
Passwords hashed with bcrypt and checked against your policy: length, reuse history, expiry and common-password block. TOTP MFA you can require for everyone, Google and Microsoft SSO for invited users, and a temporary lock after repeated failures.
Sessions and keys
15-minute access tokens with rotating refresh tokens. Signing out or deactivating a user ends their sessions at once. API keys show the secret only once, store it hashed, and can expire or be revoked.
Roles and projects
Permissions per module at none, read, modify or full, on every request. Projects keep teams apart: one project's agents, secrets and alerts never reach another unless you share them.
Secrets
Values live in HashiCorp Vault with a least-privilege policy. They never appear in database rows, API responses, logs or the audit log. Pipelines receive them once over HTTPS and mask them in the output.
Remote access
OpsNexus signs in to servers itself, so passwords and keys never reach the browser. Sessions open with single-use 60-second tickets, host keys are pinned, and idle or long sessions end on their own.
Audit
Every sign-in, change, secret reveal, deployment and remote session is written to an append-only log. Each entry includes the hash of the one before, so any edit breaks the chain. Export it as CSV for your SIEM.
Your token is read once, used once, and never shown
never stored with the run · never in the database · never in the browser
Every entry is chained to the one before it
If anyone edits or deletes an old entry, every hash after it stops matching. You can prove what happened, who did it, and in which project.
Controls you don't have to configure
Need a security review first?
We will walk your security team through the architecture and answer your questionnaire.