Security & trust
When an incident puts your business under pressure, confidence comes from knowing who has access, how decisions are recorded, and what the evidence actually proves.
Built for a considered security review by CISO, CIO, and GRC teams.
A foundation for accountable response
IR-OS combines managed infrastructure with application controls and portable incident records. Evaluate the controls against your organization's requirements and the scope of your deployment.
Supabase authentication and database row-level policies support organization-scoped access. Response roles describe responsibilities; they should not be confused with authorization to access sensitive records.
Review membership, permissions, and offboarding.The application runs on Cloudflare Workers, with Supabase providing authentication and data services. Cloudflare security rules and rate-limit configurations support protection at the application edge.
Confirm hosting, retention, backup, and recovery scope.The incident ledger retains response context and supports SHA-256 chain checks. Signed exports add an issuer signature that can be examined using the independent verifier.
Verify the export and inspect its format coverage.Independent verification
Give reviewers a portable artifact they can examine without an IR-OS account. The verifier separates chain integrity from issuer authenticity and identifies unsigned or inconsistent records.
Open the record verifierCryptographic verification confirms the covered data and signature. It does not establish that every statement is factually correct, create legal privilege, or guarantee regulatory acceptance or insurance coverage.
Review its scope, included evidence, and access classification before sharing the artifact.
Verify that linked event hashes are consistent and the signature matches the expected issuer key.
Legacy v1 signatures bind the event-chain head and selected metadata. The v2 format covers the complete exported bundle except its signature envelope. Check the schema on your actual export.
Review decisions, owners, source references, and missing information alongside the cryptographic result.
AI with human judgment
Use AI to explore response options and prepare working material. Keep your team responsible for reviewing the facts, sources, and actions that follow.
Ask AI can use available organization context and incident-response knowledge. Review which records are available to the assistant and confirm permissions before introducing sensitive material.
Inspect cited sources, dates, and applicability. AI output can be incomplete or incorrect; a draft is a starting point for qualified human review.
Confirm AI providers, retention, processing terms, and permitted data classifications during procurement. Keep sensitive legal advice within the counsel-approved workflow.
Designed for a serious buying decision
Align security, technology, and assurance requirements before deployment. Use a shared review to make evidence requests, responsibilities, and acceptance criteria explicit.
Review tenant boundaries, privileged access, administrative actions, logging, vulnerability handling, and AI permissions.
Confirm hosting dependencies, integration scope, support, backup restoration, export access, and recovery expectations.
Request applicable contractual terms, subprocessor information, control evidence, retention details, and documented exceptions.
Tell us your organization, intended use, required controls, and decision timeline. The link opens your email client.
Clear answers
No. A signature supports authenticity and integrity of the covered data. Compliance depends on the applicable obligations, the underlying facts, and the actions taken. Review the record with the appropriate legal and assurance specialists.
IR-OS uses Supabase authentication with application session handling. Confirm the identity configuration, session requirements, offboarding process, and any enterprise identity integration during your security review.
Existing plan options include NIST, ISO/IEC 27035, CISA, SANS PICERL, and the IR-OS Expert template. Framework selection supports planning; it does not confer certification. Review the version and applicability of your selected plan.
NIST SP 800-61 Rev. 3 supersedes Rev. 2. Existing legacy templates should be reviewed against current guidance.
Planning estimates require confirmation of applicability, the triggering event, and the correct calendar. Record the reviewed obligation, owner, and evidence. For example, SEC Item 1.05 generally uses four business days after a materiality determination, not a fixed 96 hours after discovery.
Start with the privacy policy and subprocessor information. Request current documentation for your deployment. Confirm required certifications, residency, a BAA, and contractual commitments explicitly; a roadmap item is not a delivered control.
Agree on your security contacts, escalation route, contractual notification requirements, and follow-up reporting during procurement. Notification obligations depend on the incident and applicable law; one universal reporting deadline does not apply to every customer.
Security is a conversation backed by evidence
Bring your requirements. Examine the workflow. Confirm the controls and commitments your organization needs before deploying.
For vulnerability reports, include reproduction steps and the affected component. Do not include customer records or secrets. Coordinate disclosure and avoid accessing data you do not own or disrupting service.