Security / questionnaire
The questions
everyone asks.
Plain answers, in the order a security review tends to ask them. Each carries a label: Yes means it works today, Plan-dependent means it depends on your plan, Not yet means it does not exist, and Ask us means the honest answer needs a conversation.
Access and identity
Who can get in, and how fast you can shut the door.
How do users sign in?
YesWith single sign-on over OIDC or SAML, or with email and password. Passwords are hashed with argon2.
Is single sign-on available on every plan?
Plan-dependentNo. SSO depends on your plan. We map it to what you need in the demo.
Team and accessDoes Onscryn enforce multi-factor authentication?
Ask usThe way to enforce MFA today is through your identity provider with SSO, which applies its own second factor. We don't claim a built-in second factor for email and password sign-in.
What roles exist?
YesOwner, admin, member and viewer, all scoped to your organization. Owners and admins manage members and domain rules in Settings and Members.
How quickly does access end when someone leaves or changes role?
YesOn their next request. Every request is checked against a token version, so removing someone or changing their role makes the next call fail. Nothing waits for a token to run out.
Access should end on the next requestCan we provision and deprovision users automatically (SCIM)?
Not yetNo. SSO handles sign-in, and members are managed in the dashboard. SCIM provisioning is not available today.
Can outsiders get access without a VPN or a network connection?
YesYes. People open a browser tab to the one application they are allowed to use. They are not placed on your network.
Secure remote accessData and isolation
Where the data sits, and what can leave.
Where does the application and its data live?
YesOn a managed Windows host. Users receive a rendered stream of the screen, not the application or its files.
How data flowsCan we run the hosts ourselves?
YesYes. Hosts are Windows machines running the Onscryn agent, and you can enrol your own. If your hosts are at capacity, sessions can fall back to the shared pool, so tell us if your data must stay on your own hosts.
Hosts and infrastructureHow are two users' sessions separated?
YesAt the Windows account level. Each session gets its own local user on the host, and that account and its profile are removed, or scrubbed before reuse when warm pooling is on, once the session ends. This is not a separate virtual machine per session, and we don't describe it as one.
Choosing an isolation modelIs dedicated hardware available for stronger separation?
Plan-dependentDedicated hosts are plan-dependent. If your threat model needs more than account-level separation, talk to us.
Can we block copy and paste, or file transfer?
YesYes, each one separately, per app and per organization. The broker that carries the stream enforces it, so a user can't switch it back on from the browser. Both default to on until you change them.
Data protectionWhen does a policy change take effect?
YesFor new sessions. Policy is read when a session launches, so sessions already running keep the policy they started with.
Can screens be watermarked?
YesYes. The viewer's email and the time are drawn into the streamed pixels, so a photo of the screen carries them too. The watermark is off by default.
Is traffic encrypted in transit?
YesBrowser connections to Onscryn use HTTPS and secure WebSockets.
How is data encrypted at rest, and where is it stored geographically?
Ask usThis depends on where your hosts run and which plan you are on. We will give you the specifics for your deployment during a security review rather than a blanket statement here.
Recording, audit and AI
What you can see afterwards, and what the automation touches.
Can sessions be recorded?
Plan-dependentYes, per app or organization, and replayed frame for frame. Recording is labelled Beta, depends on your plan, and is decided when a session launches. Recordings sit in object storage and are replayed through a short-lived signed link.
RecordingsIs there an audit log?
Plan-dependentAccount and automation events are written to an audit log, and every Copilot run keeps a step-by-step record of what it did. The audit log is plan-dependent.
What an audit trail needsHow does the AI Copilot work, and what does it see?
YesThe Copilot is labelled Preview. It uses a language model to choose steps and acts through the application's UI tree, one step at a time, so it can only use controls the application exposes. The model is provided by Groq, so the task text and the UI-tree content needed for each step go to that provider while a run is in progress.
AI CopilotCompliance and operations
What we claim, and what we leave unclaimed.
Do you hold a SOC 2 report, ISO 27001 certificate or similar?
Ask usOnscryn does not currently claim a SOC 2 report or an ISO 27001 certificate on this site. The controls described on these pages are product behaviour, not an auditor's opinion. If you need an attestation, tell us which one and we will be direct about where we stand.
Is Onscryn HIPAA or GDPR compliant?
Ask usWe don't make a blanket compliance claim. Compliance depends on how a product is used as well as how it is built. Tell us your requirement and we will walk through what applies.
Have you had a third-party penetration test?
Ask usAsk us for the current position. We would rather say 'not yet' than imply a report exists.
How do we report a vulnerability?
YesBy email, under our disclosure policy. It covers scope, what to include and how we respond.
Vulnerability disclosureWho are your subprocessors?
YesOVHcloud for hosting, Cloudflare for DNS, Resend for email, Groq for the AI Copilot, and Google Analytics on the marketing sites. The subprocessors page says what each one handles.
SubprocessorsIs there a public status page?
Not yetNot today. If you need to know about an incident, contact us and we will tell you directly.