OKTO Dedicated instance, hosted in Quebec
Every subscriber gets their own instance and PostgreSQL database, on OKTO Solutions' servers, in Quebec. No data shared between subscribers. Docker images pinned by digest, TLS terminated by us.
Security and hosting
An RMM is a key to all your clients. We built it that way.
An OKTO RMM subscriber's data lives in a dedicated instance and a dedicated PostgreSQL database, hosted in Quebec on OKTO Solutions' servers. Two-factor authentication by passkey or app can be enforced for the whole team, secrets are encrypted with AES-256-GCM, every organization is isolated in the database, and every action is written to an audit trail with a checksum.
Every point on this page corresponds to code in console version 34.83 or agent 25.77.
Two-factor authentication, enforceable
TOTP by app or WebAuthn passkey. The partner can enforce it for the whole team; the client role always has it. Step-up MFA is required again before a risky action: isolating a device, acting on a threat, touching an integration.
Verifiable audit trail
Every action carries the actor (user, API key, agent, system), the action, the resource, the IP address, the result (success, failure, denied) and an integrity checksum. Configurable retention, never under 30 days.
Secrets encrypted at rest
Integration credentials, two-factor secrets and the device lock vault are encrypted with AES-256-GCM, in a versioned format with a key identifier for rotation. Nothing in clear text in the database.
Isolation in the database
Every client table carries PostgreSQL row-level security policies. An organization's token cannot read another organization, even through a coding mistake in the interface.
Signed binaries, published fingerprints
The Windows agent, watchdog and user helper are signed with Azure Trusted Signing in OKTO Solutions' name and timestamped. Distribution manifests are signed; SHA-256 fingerprints are recorded in the console.
Sessions and access
Who has access to what, and how do you know?
Trusted devices, one-click sign-out of every session, revocable refresh-token families, rate limiting of 5 attempts per 5 minutes on two-factor verification. Remote desktop relay credentials are temporary, HMAC-signed and valid ten minutes. Outbound requests to your integrations go through a client that refuses redirects and pins the resolved address.
- Roles with 55 permissions on 21 resources, system roles cloneable
- SSO OIDC and SAML, permission-scoped API keys, OAuth connected applications
- Built-in assistant under guardrails: tools classed by tier, high-risk actions require approval and MFA
9:41 a.m.user m.tremblay · devices:isolate · step-up MFA missing · 24.48.x.xDenied
9:42 a.m.user m.tremblay · mfa:stepup · verifiedSuccess
9:42 a.m.user m.tremblay · devices:isolate · PC-FRONTDESKSuccess
11:07 a.m.API key “monthly-report” · organizations:write · outside permissionDenied
2:20 p.m.agent PC-ACCT-03 · inventory:refresh · checksum validSuccess
On the devices
The agent also watches the device's own security.
- Antivirus read natively: Defender and third-party through Windows Security Center
- BitLocker, firewall, firmware, threats and quarantine
- CIS benchmarks for Windows, macOS and Linux with remediation under approval
- USB peripheral control by policy
- Temporary privilege elevation, revocable, logged
- Sensitive data discovery, file encryption and secure deletion
- Incident response: evidence collection, containment
What we do not claim
No seal we do not have.
OKTO RMM is not SOC 2 or ISO 27001 certified today. Our controls line up with those frameworks and we keep the documentation ready for a cyber-insurance or end-client questionnaire. If your contract requires a formal attestation, tell us before rather than after.
A subscription agreement, a data processing addendum compliant with Quebec's Law 25 and a service level agreement come with every subscription.
Ask a security question →Questions
The questions we get about security.
Where is OKTO RMM data hosted?
In Quebec, on OKTO Solutions' servers, in an instance and a PostgreSQL database dedicated to each subscriber. No data is shared between subscribers. Docker images are pinned by digest and TLS is terminated at OKTO.
Can OKTO Solutions read my data?
The team only enters an instance for support, at the subscriber's request, and every action is recorded in the audit trail with the actor, the action, the address and the result. Integration and two-factor secrets are encrypted with AES-256-GCM.
Is two-factor authentication mandatory?
It can be. The partner enforces it for the whole team with a single setting. The client role always has it. Step-up MFA is asked again before a risky action such as isolating a device or changing an integration. TOTP apps and WebAuthn passkeys are supported.
Is OKTO RMM SOC 2 or ISO 27001 certified?
No, not at this time. The controls line up with those frameworks and the documentation is available for a cyber-insurance or end-client questionnaire. If a contract requires a formal attestation, it is better to say so up front.
How do I know the installed agent is really OKTO's?
The Windows agent, watchdog and helper are signed with Azure Trusted Signing in OKTO Solutions' name and timestamped. Distribution manifests are signed and SHA-256 fingerprints are recorded in the console. A modified binary does not get through.