Sealed servers
After a new instance is installed, its server is sealed: the installation keys are removed and nobody keeps standing SSH access. From then on the instance updates itself from signed releases.
// seal.instance_server
Security built into every instance
New OpenOrange instances run on sealed servers that install only signed releases, with staff access only while you allow it. Encrypted logs, backups, and snapshots are coming soon.
OpenOrange keeps each customer’s instance on its own server and limits who can reach it. New instances are sealed: nobody holds standing SSH access, updates arrive as signed releases, and our staff can sign in only while you open maintenance access.
Public launch coming soon. Join the waitlist or email contact@openorange.ai.
01
Sealed servers with no standing SSH access.
02
Only signed releases install on new instances.
03
Staff access only while you open it, with every opening logged.
04
Encrypted conversation and request logs with the next release.
Signed releases
Every OpenOrange release is signed when it is published. A new instance checks the signature before it installs an update and refuses anything unsigned or altered.
Access only when you allow it
When maintenance needs the server, an owner opens access for one hour from the dashboard and can end it early. Every opening, and every reveal of the server’s console password, is written to the audit log.
Guarded actions
Privileged operations run through an executor with explicit deny rules, and each action is written to a tamper-evident log before it starts. Secret values stay in local files or secret backends.
Encrypted logs
Coming with the next release: new instances encrypt conversation and request content at rest by default. Owners choose how long request content is kept and whether administrators can view it, and every view is audited.
Backups and snapshots
Coming soon: opt-in daily backups and snapshots of every machine, plus nightly backups stored off the server.
// Questions
Can OpenOrange staff sign in to my server?
Not on a new instance unless you let them. Staff can sign in only while an owner has opened one-hour maintenance access, and each opening is logged.
Are my logs encrypted?
Encryption at rest for conversation and request content comes to new instances with the next release. Model providers you configure still see the content they process.