Meeting modern data control expectations requires guarantees that the intended applications are exclusively the apps that can connect to your systems. Ockam moves trust to the application layer by building a mutually authenticated and encrypted communication channel between those systems.

Sharing secret keys across many apps and services increases the likelihood of secret keys leaking, in addition to eroding any guarantees that only intended apps can access sensitive data. Teams then layer in additional credential management approaches, network-level controls, and various other security approaches in an attempt to have a somewhat reliable assumption that only the intended app(s) were able to use the shared secret keys.

With Ockam, each app generates it's own unique cryptographically provable identity and encryption keys, and uses those keys to establish trusted secure channels directly with other authorized apps as required.

Whether it's reading a credential or secret value from a central source, or transmitting a secret key to another app, every time a secret value is transmitted over the wire is another opportunity for it to leak. Ockam's approach to secret management means each secret key never needs to leave the place where it was generated. By removing the need to transmit secrets the risk of an attacker intercepting a secret in transit is also removed.

Everyone hopes they never have a data breach, but to minimize the impact in case the worst happens Ockam apps automatically and regularly rotate their encryption keys. If a secret key is ever leaked the data at risk is reduced to the amount sent in the small window of that secret key was active. Don't put your historical and future data at risk because rotating secret keys is difficult— it's built-in from the start.

The approach to mutual authentication of every app that Ockam provides results in strong data governance guarantees around the authenticity and integrity of the data moving through your system.

Ockam's approach uses existing and well established open source technologies and frameworks. We build trust through transparency so your CISO can be confident everything meets their requirements. The cryptographic and messaging protocols are publicly documented and the implementations are open source and available on GitHub.

We've published an independent third-party audit by the security research firm Trail of Bits, we've passed the security reviews of our major partners, and we're SOC2 compliant.

The current status of our latest audits and compliance controls are also available.

Nobody loves running their own PKI. It's complicated, you still need to work out how to securely handle your root certificate and keys, have policies around lifecycle management… a lot of extra infrastructure and orchestration.

With Ockam, each app generates keys and establishes trust directly there's no need to run your own PKI systems.

Ockam can work with any language. You've the flexibility to write your applications in a mix of Java, Python, Go, Scala, you name it!

Ockam is agnostic to network-level and cloud-specific features. Whatever cloud you're on, even if you're running a multi-cloud setup, Ockam is a single approach that will provide secure point-to-point wherever you need it.

Ockam Orchestrator is a cloud-based fully managed solution that allows you to be successful within minutes. With SLA guarantees and publicly available historical uptime reporting, it's the preferred deployment approach for the majority of customers. For those with specific self-managed deployment requirements, Ockam Business Critical provides options for running entirely within your own VPC or on-prem.