Security & compliance

OKR.ai is built to be easy to approve. You run it inside your own boundary, the code is open, and the dependency list is short enough to read in one sitting.

#What self-hosting removes

A SaaS OKR tool stores your strategy, org chart and team performance with a third party. In a large company that usually triggers:

• a vendor risk assessment and security questionnaire;
• a review of the vendor’s SOC 2 or ISO 27001 report;
• a data processing agreement and a new entry in your sub-processor list;
• a data-residency check against the vendor’s hosting regions.

With OKR.ai self-hosted, the project never receives your data, so there is no hosted vendor to assess. Your data lives in infrastructure you already approved, in the region you choose. Security teams can review the source code directly.

#Who can see what

Full OKRs, progress, initiatives and evidence are visible only to you, your direct manager and your direct reports. Further up or down the org, people see objectives and key results only, never progress. This is enforced on the server for every request, not just hidden in the UI.

#Secrets

• Database connection strings, AI keys, MCP tokens and SSO client secrets are encrypted at rest with OKRAI_SECRET_KEY.
• Stored secrets are never sent back to the browser.
• OKR.ai refuses to start in production without a secret key.

#Sessions and requests

• HMAC-signed sessions in HttpOnly, SameSite=Lax cookies.
• Every RPC call requires a CSRF token and passes a same-origin check; cross-origin requests are refused.
• OIDC uses PKCE and verifies ID tokens against the provider’s JWKS.

#AI and connected content

• Every AI answer is schema-validated, and every id it returns is checked against OKRs the user can see before anything is written.
• The MCP client reads resources and calls only read-only, argument-free tools.
• Connected content is passed to the model as data, never as instructions.
• Docs and page crawls run behind an SSRF guard that blocks private-network hosts unless OKRAI_ALLOW_PRIVATE_URLS=1.

#Supply chain

OKR.ai ships 7 runtime packages: next, react, react-dom, zod, pg, openai and @anthropic-ai/sdk. A new package is added only when there is no reasonable alternative. OIDC, sessions, SMTP, CSV parsing, DOCX extraction and the MCP client are written on Node built-ins. npm audit reports 0 vulnerabilities.

#Reporting a vulnerability

Please report security issues privately with the bug button at the bottom-right of any page or of the app. Reports go only to the maintainers and are never published. Include steps to reproduce and the version you tested. We’ll acknowledge the report and keep you updated until a fix ships.