OFFICIAL LEGAL POLICY

Security & Sovereignty Architecture

Enterprise defense-in-depth architecture engineered for critical infrastructure, continuous chemical plants, and air-gapped defense manufacturing.

EFFECTIVE DATE: September 5, 2026

VERSION: 3.9

JURISDICTION: Delaware, USA & Global Cross-Border

1. Security Philosophy & Zero Trust

Traditional industrial software relies on perimeter firewalls that leave plant networks vulnerable once breached. Optruss operates on a strict Zero Trust Architecture (NIST SP 800-207) where no user, sensor node, or execution agent is inherently trusted.

Every internal API call, telemetry ingestion stream, and supervisory work order dispatch requires continuous cryptographic authentication and authorization.

2. Air-Gapped Edge Cluster Isolation

The Optruss Zero-Copy Tap daemon and edge compute runtimes operate autonomously on bare-metal hardware completely decoupled from public internet connectivity:

Unidirectional Data Diode Compatibility: Ingestion taps interface directly with hardware optical data diodes preventing any inbound packet transmission from external zones.
Local Inference Autonomy: High-frequency FFT transformations, acoustic envelope demodulation, and ISO 14224 fault trees execute entirely on localized DSP cores.
Secure Boot & TPM 2.0: Every hardware appliance enforces cryptographic root-of-trust verification upon boot, rejecting modified firmware images.

3. Cryptographic Merkle Audit Trail

To satisfy strict regulatory audits (OSHA PSM, EPA Clean Air Act, NERC CIP), all autonomous agent evaluations and supervisory operator approvals are hashed into a tamper-evident Merkle tree.

Any unauthorized modification to historical vibration records, work order timestamps, or derate logs instantly invalidates cryptographic root hashes, providing indisputable proof of operational compliance.

4. Compliance Standards & Certifications

Optruss systems undergo rigorous third-party auditing against global standards:

SOC 2 Type II

Annual audit covering Security, Availability, and Confidentiality trust principles.

ISO / IEC 27001:2022

Certified Information Security Management System (ISMS) across all product operations.

IEC 62443-4-1 / 4-2

Industrial cybersecurity lifecycle and technical component security standards.

NERC CIP-002 through CIP-014

Cybersecurity standards for North American bulk power and electrical grid installations.

5. Vulnerability Disclosure & Bug Bounty

We welcome coordinated vulnerability disclosures from security researchers. If you identify a potential vulnerability in Optruss code or edge appliances:

Please submit encrypted reports via PGP to [email protected]. We provide safe harbor for good-faith security research conforming to our guidelines.

6. Purdue Model OT Network Integrity

Optruss respects the sanctity of the Purdue Enterprise Reference Architecture (PERA). Our edge hardware resides at Level 2/3 (Control Systems / Site Operations), strictly segregated from Level 1 (Sensors/Actuators) safety interlocks and Level 4/5 (Enterprise IT) corporate networks.

Explore full interactive Technical Security Whitepaper →