Security

ownMDM is pre-launch and self-hostable. We take customer trust seriously: every action by ownMDM staff against your tenant is visible to you in real time, and our security posture is documented honestly. The list below reflects what's in production today — not a roadmap.

Encryption

✓TLS 1.2+ for all data in transit (NPM-terminated)
✓bcrypt password hashing (cost factor 12) with timing-safe comparison
✓Secrets isolated to env vars; never logged, never in API responses

Authentication & 2FA

✓JWT in HttpOnly, SameSite=Strict cookies
✓Mandatory TOTP 2FA for owner / super_admin (24h grace window)
✓Per-tenant 2FA enforcement available (tenant owner toggle)
✓SAML 2.0 / LDAP SSO integration
✓5-attempt login lockout with exponential backoff (60s–600s)

Infrastructure

✓The self-hosted edition is source-available under FSL-1.1-ALv2 (converts to Apache-2.0 two years after each release)
✓Docker with health checks, no privileged containers
✓Tenant isolation via tenant_id scoping enforced at every query
✓Subdomain routing with JWT cross-tenant validation
✓Five-layer defense (JWT → middleware → permission → row scoping → nav guard)

Monitoring & customer audit

✓Prometheus + Grafana observability
✓Loki log shipping
✓GlitchTip error tracking with PII scrubbing
✓Customer-visible platform-access log — every staff action against your tenant, surfaced in your admin UI
✓Email notification when ownMDM staff begins a support session

Application security

✓SSRF prevention with DNS pinning + URL re-validation
✓Command injection protection (shlex.quote + whitelisted templates)
✓Origin header validation on state-changing requests
✓Cross-tenant access requires written justification (logged + emailed)
✓Cross-tenant pentest 2026-04-27: 0 exploitable leaks

Compliance posture

✓GDPR Data Processing Agreement available on request
✓SOC 2 Type I evidence collection in progress (target Q3 2026)
✓Operational audit logs 90 days; security events 7 years
✓Customer data export via API + admin portal
✓Cookie consent + privacy policy

Need a DPA or security questionnaire?

We provide Data Processing Agreements, security documentation, and respond to vendor security assessments.

Contact Security Team