Security & compliance

Where your data lives

OKR Studio runs entirely on Microsoft Azure inside the European Union. There is no US region and no option to move your data outside the EU.

• Application, database, and file storage run in Azure West Europe.
• AI features run on Azure OpenAI Service in Sweden Central, which is also inside the EU.
• Transactional email is delivered through Azure Communication Services with an EU data location.
• Backups and geo-redundant storage stay within EU-paired Azure regions.

Encryption

Every connection to OKR Studio is encrypted, and stored data is protected by Azure platform-managed encryption.

• All traffic is HTTPS. TLS 1.2 is enforced as the minimum across the database, storage, application, and background services.
• HTTP Strict Transport Security is set for one year including subdomains, alongside a Content Security Policy, X-Frame-Options: DENY, and X-Content-Type-Options: nosniff.
• Database connections are encrypted with certificate validation enabled.
• Data at rest is protected by Azure SQL Transparent Data Encryption and Azure Storage Service Encryption.
• Session cookies are HttpOnly and Secure.

Authentication and access

You can sign in with an email and password or through an identity provider, and you can require two-factor authentication for everyone in your organization.

• Single sign-on with Microsoft Entra ID, Google, or GitHub, implemented over OIDC.
• Time-based one-time password (TOTP) two-factor authentication, compatible with any standard authenticator app.
• Administrators can require MFA across the entire organization, not just per user.
• Role-based access control with four roles — Admin, Product Leader, Team Member, and Stakeholder — enforced on every create, update, and delete action.

How organizations are kept separate

OKR Studio is a multi-tenant application. We think you should know exactly how that separation is implemented rather than being told it is simply secure.

• Every authenticated request carries an organization identifier, which is validated server-side before any record is returned or modified.
• Database access runs through parameterized stored procedures that take the organization as an explicit parameter, so queries cannot return another tenant's rows.
• Ownership and permission checks run as separate layers on top of that organization scoping.
• To be precise: this is application-layer isolation on a shared database schema. We do not use per-tenant databases or SQL Server row-level security.

Your data, and getting it back

You own your data. We have built the export and deletion paths that GDPR requires, and they work without you having to email anyone.

• One-click export of everything we hold about a user, in machine-readable JSON.
• Account deletion removes access and anonymizes personal information.
• We do not sell your data, and we do not share it with third parties for their own purposes.
• Our sub-processors are published and kept current.

How AI features handle your content

AI is opt-in. If your organization does not want its content sent to a model, an administrator can turn the features off.

• AI requests are processed by Azure OpenAI Service within the EU.
• Your content is not used to train foundation models.
• AI features require explicit consent before first use, and AI-generated content is labelled as AI-assisted in the product.
• The deterministic parts of the product — progress, pace, and at-risk calculations — are computed by us, not by a model.

We do not hold either certification today. Our infrastructure runs on Azure, which does hold them, but inheriting a provider's certification is not the same as holding your own and we will not describe it as though it were.

We support Microsoft Entra ID over OIDC, which covers sign-in but not directory-driven provisioning. If your organization mandates SAML or SCIM, we do not meet that requirement yet.

There is no self-serve audit log for administrators to export today.

There is no US or APAC region. If your organization requires data to stay outside the EU, we are not a fit.

We do not publish a standing SLA. Uptime commitments can be discussed as part of an Enterprise contract.