Skip to content
OpClerk
Trust

Built to clear your security review.

OpClerk is sovereign by design. It deploys inside your environment, sends nothing to a vendor cloud, and is built to support the obligations your regulators and security team already hold you to.

On-premisesSovereign cloudAir-gap friendly
Request a DemoSee framework coverage

Your keys, your data, your perimeter — no rule, IP, configuration, or log ever leaves your network.

trust/posture.json
deploymenton-prem · sovereign cloud
data egressnone
encryption keysheld by you
data residencyyour region
air-gapsupported
no rule · IP · config · log leaves your networkby design
Deployment & sovereignty

You choose where it runs. It never phones home.

OpClerk installs inside your environment as a self-contained deployment and operates with no dependency on any vendor cloud. The global platforms can't structurally lead with this — for a regulated MENA bank, telecom, or ministry, it's the precondition.

Deploy on-premises, in your sovereign cloud, or inside an air-gapped enclave.
Runs as a self-contained .NET deployment — no agent calls out to a vendor.
No telemetry and no phone-home: the platform operates fully offline if you require it.
Updates ship as signed artifacts you review and apply on your own schedule.
No rule, IP, configuration, or log ever leaves your network.
perimeter/data-flow
customer perimeter — no egress
Palo Altofw-core-01
Fortinetfw-dc-04
Cisco ASAfw-edge-02
Cloud security groupsazure · aws · gcp
normalized into one ledger
OpClerk PolicyManager
on-prem · keys held by you
outbound → vendor cloudnone
Data control & residency

You hold the keys. You hold the data.

Your policy is one of the most sensitive maps of your network there is. OpClerk treats it that way — it stays where you put it, encrypted with keys you control.

Encryption keys are held by you and never escrowed to OpClerk.
Full data residency: storage and processing stay inside the region you choose.
You own the database and backups, and can export or delete on your terms.
Integrates with your identity provider, so accounts live in your directory.
Your policy data is never used to train models or shared across deployments.
data/custody.txt
encryption keysheld by you
data at restencrypted
data in transitencrypted (TLS)
data residencyyour region only
identityyour provider
Access, audit & governance

Every action is scoped, approved, and recorded.

OpClerk is built around least privilege and segregation of duties, with an immutable trail behind every change — the same discipline your auditors expect of you.

Role-based access control with least-privilege roles out of the box.
Segregation of duties: whoever requests a change can't be the one who approves it.
Every change carries pre-change validation and a recorded, multi-step approval.
An append-only, tamper-evident trail of who did what, when, and why.
Export the trail as timestamped, examiner-ready evidence on demand.
audit/change-CR-2291.log
requester · CR-2291 — tighten any → 10.0.0.0/8submitted
validation · pre-change check — no new exposurepassed
approver · segregation of duties enforcedapproved
ledger · record sealed, append-onlyimmutable
RBAC · SoD · append-onlymapped → SAMA CSF 3.3.9
Compliance obligations

Designed to support the frameworks you're held to.

OpClerk maps firewall policy to the controls your regulators and auditors examine, and exports the evidence — so the platform helps you meet and prove your obligations under each framework.

OpClerk does not claim to hold these certifications itself. These are the obligations the platform is designed to help your organization satisfy and evidence — inside your own perimeter.

SAMA CSF
Saudi Central Bank
NCA ECC
Essential Cybersecurity Controls
NCA CCC
Cloud Cybersecurity Controls
UAE NESA / IA
Information Assurance Standard
CBE Egypt
Central Bank of Egypt
SWIFT CSP
Customer Security Programme
ISO 27001
Information security management
PCI DSS
Payment card security
NIST CSF
Cybersecurity framework
Procurement & assurance

Built to move through your security review.

We expect the hard questions — and we've packaged the answers your security, risk, and procurement teams need to clear the file.

Deployment and architecture documentation for on-prem, sovereign-cloud, and air-gapped models.
Data-flow diagrams that show, explicitly, that no policy data leaves your network.
The role-based access and segregation-of-duties model, ready for your reviewers to assess.
Sample audit-evidence exports mapped to SAMA CSF, ISO 27001, and PCI DSS controls.
A walkthrough against a sample of your own policy, inside your perimeter, before you commit.

Exact technical specifics — versions, ciphers, and configuration — are confirmed against your standards during your security review.

Responsible disclosure

Found a security issue? Tell us.

If you believe you've found a security issue in OpClerk, we want to hear about it. Until a dedicated security address is shared for your engagement, reach the team through the contact and demo flow and mark your note “security — responsible disclosure.” We'll route it to the right people and acknowledge it.

Contact the team

Bring OpClerk into your security review.

A walkthrough on your policy, your frameworks, your perimeter — nothing leaves your control, and your reviewers get the evidence they need.

Request a DemoSee SAMA CSF mapping