Security, compliance and transparency for quality management
1. Trust Center overview
This Trust Center summarizes the security, compliance, privacy and resilience practices supporting Octave Reliance. Additional controlled documentation may be available to qualified customers and reviewers upon request. Section 15 summarizes the FedRAMP security outcomes supported by the practices described in this document.
2. Security and compliance certifications
Octave Reliance maintains certifications that demonstrate its commitment to quality and information security.
ISO 9001:2015 - Active (since 2007) - Quality Management System: Demonstrates the organization’s commitment to consistent quality.
ISO 27001:2022 - Active (since 2020) - Information Security Management System: Demonstrates a structured approach to protecting information.
FedRAMP Rev. 5 - Pursuing authorization - Octave Reliance is pursuing FedRAMP authorization. Authorization process underway with A-LIGN assessor.
3. Cloud service offering overview
Octave Reliance is a browser-based enterprise quality management system (eQMS) delivered as software as a service (SaaS) in AWS GovCloud. It supports configurable workflows, electronic records and signatures, audit-trail capabilities, reporting, administration and integrations. Federated SAML 2.0 single sign-on (SSO) is the authentication method covered by this Trust Center; local authentication is outside the FedRAMP scope. Customer environments are protected through logical tenant separation controls.
4. Shared responsibility model
Security and compliance are shared. Octave secures and operates the cloud service; customers secure their identities, access, configurations, integrations and use of data.
Octave responsibilities
Cloud infrastructure and platform security
Monitoring, vulnerability management and incident response
Backup, recovery, maintenance and platform audit capabilities
Customer responsibilities
Manage named users, roles, least-privilege access and periodic access reviews
Configure the identity provider, single sign-on (SSO) and multi-factor authentication (MFA), as applicable
Protect integrations, validate customer configurations, review audit records and define data retention requirements
Additional customer configuration guidance is provided through the Secure Configuration Guide.
5. Security architecture and infrastructure
Octave Reliance uses a defense-in-depth security architecture designed to support government security requirements across the AWS GovCloud infrastructure, network, platform, application, identity and data layers.
AWS GovCloud deployment: Octave Reliance [MP1] [SV2] stores and processes all customer data within AWS GovCloud (US), in accordance with the applicable service architecture and customer agreement.
Defense-in-depth architecture: Security controls are applied across the authentication and access-control, platform, data and integration layers and are designed to align with applicable NIST requirements.
Encryption: Data in transit is protected using TLS 1.2 or higher and data at rest is protected using AES-256 encryption. Encryption keys are managed through documented key-management processes.
Access controls: Configurable role-based access controls, SAML 2.0 SSO and MFA support government security requirements.
Audit-trail capabilities: Data validation, checksums and audit trails support applicable records-management and compliance requirements, including 21 CFR Part 11 where applicable.
Reliability and scalability: Elastic infrastructure supports changing demand. Availability commitments are defined in applicable customer agreements.
Network security
Network segmentation: Development, testing and customer environments use separation controls appropriate to their functions.
Firewall protection: A cloud-based secure internet gateway and related network controls help protect the service.
Threat prevention: Attachments are scanned for malware and endpoint-protection controls are used where applicable.
6. Security and threat management
Vulnerability management: Vulnerability assessments use established tools and methods, including static and dynamic application security testing where applicable. Findings are prioritized by risk and remediated through documented processes.
Penetration testing: Penetration testing is performed periodically in accordance with the security assessment program, including at least annually where required.
Threat protection: Endpoint-protection and threat-detection capabilities support analysis and containment activities.
Security monitoring: Security events, activities and system changes are centrally collected, monitored and analyzed using security monitoring and logging capabilities, with documented response procedures for identified threats.
Incident response and independent assessment: Documented processes support incident response and independent security assessment activities.
7. Compliance and data protection
Data residency: Octave Reliance stores and processes all customer data within AWS GovCloud (US), in accordance with the applicable service architecture and customer agreement.
Tenant separation: Customer environments are protected through logical tenant separation controls.
Security logging: The platform records relevant user activities and system changes and provides authorized access to audit information where supported.
Secure data deletion: Documented data-deletion procedures are applied in accordance with contractual, operational and applicable regulatory requirements.
Customer governance: Customers define retention requirements and review audit records according to their policies and applicable regulations.
8. Business continuity and resilience
Documented backup, recovery, monitoring, change management, incident management and continuity processes support service availability. Recovery capabilities are periodically tested through documented recovery and continuity exercises to validate support for service availability objectives. Availability commitments are defined in applicable customer agreements.
9. Secure configuration guidance
The Octave Reliance Secure Configuration Guide provides recommendations for federated SAML 2.0 SSO, MFA, user lifecycle and administrative access, role-based access control, integration credentials, least privilege and access reviews. Local authentication is outside the FedRAMP scope. Customers should apply relevant recommendations based on their policies and risks.
10. Security documentation
Public resources include product documentation, release notes, knowledge-base articles, support resources, training materials and the Secure Configuration Guide. Additional security or compliance documentation may be provided to authorized reviewers after verification of affiliation, business need, approval and any required confidentiality terms.
11. Vulnerability disclosure and security reporting
Customers, partners and security researchers may report suspected vulnerabilities to Reliance.Compliance@octave.com. Please provide a description of the issue, affected functionality, reproduction steps and supporting evidence where available. Reports must not involve unauthorized access to data, service disruption, modification of information, or destructive testing.
12. Professional services and customer support
Multi-channel support: The Octave Community portal is available for submitting support requests. The Support Solutions team manages customer cases.
Knowledge base and documentation: Documentation, release notes and frequently asked questions are available through the customer portal and academy platform.
Community and training: Reliance Academy Online offers certifications and training modules and Octave Community supports peer networking and best-practice sharing.
User conference: The annual End User Conference brings together quality professionals to share innovations and industry best practices.
13. Contact information
For security inquiries, compliance questions, or questions about the FedRAMP authorization process, contact Reliance.Compliance@octave.com. For technical support and product questions, use the Octave Community Portal: https://smartcommunity.hexagonppm.com/. For sales or licensing information, contact your Octave representative.
14. Security and transparency commitment
Octave Reliance is committed to providing secure, compliant quality management solutions supported by its ISO 9001 and ISO 27001 programs. Octave Reliance is pursuing FedRAMP authorization and its security and compliance practices are designed to support applicable customer and government requirements.
15. FedRAMP security outcomes
Octave Reliance security practices are designed to support FedRAMP security outcomes across identity and access management, information protection, logging and monitoring, resilience and vulnerability reporting. These practices include:
Federated SAML 2.0 SSO, MFA support, named-user administration, role-based access controls, least privilege, periodic access reviews and protection of integration credentials.
Protection of data in transit using TLS 1.2 or higher and protection of data at rest using AES-256 encryption.
Central collection, monitoring and analysis of security events, activities and system changes, supported by documented response procedures and platform audit information.
Documented backup, recovery, continuity and incident-management processes, including periodic testing of recovery capabilities against service availability objectives.
A defined channel for reporting suspected vulnerabilities, supported by safe-testing expectations and documented handling processes.
Supporting evidence. Detailed measurements, validation records, assessment materials, Security Decision Records and other controlled certification data are maintained and shared through approved review processes, as applicable. This public summary does not, by itself, represent a FedRAMP certification decision.