Security is the product, not a feature.

Every layer of ocatis is built so that an organization can run AI for its whole staff without giving up control over credentials, access or data location.

Start trial Book a demo

Layered security sheets with a shield and check on the frontmost card

Security in depth

Requests pass through distinct layers — identity, tenant scope, model and tool governance — and each layer enforces its own boundary before the next one sees the request.

1
Identity — who you are, and which workspace you enter
2
Tenant scope — every query limited to your organization
3
Model governance — which models and reasoning rules apply
4
Tool policies — what MCP tools may do on your behalf

Technical measures

Encryption

AES-GCM at rest for API keys and MCP secrets, TLS in transit.

Authentication

Email and password with Argon2 hashing, Google OAuth; SSO with SAML, OIDC and SCIM in Enterprise.

Tenant isolation

Database-level tenant scoping, no cross-tenant access.

Audit trail

Durable, tenant-scoped audit logging of administrative and commercial events, with CSV export in Business and Enterprise.

Secret management

Encrypted credential vault; provider keys never leave your deployment in plaintext.

MCP sandboxing

Docker-isolated tool execution with per-tool policy enforcement.

Data sovereignty

Self-hosted by design, or cloud-managed in EU data centers
Your data, your infrastructure, your jurisdiction
EU customers contract with itcv GmbH; a Data Processing Agreement is available
No data sharing with third parties, no advertising analytics, no training on your data

Next: Memory →