Isolation inside the database. One permission check for every route in. An audit log that shows when it has been tampered with. And a support team that cannot open your workspace unless you let it.
OpenOKR is open source. Every control on this page is in the code, and most of them are enforced by a test that fails the build if somebody removes them. Your security team can read the source, run it on their own machine and point their own tools at it.
Every business table carries its workspace and a row-level security policy in PostgreSQL, shipped in the same change as the table. The application's database role cannot bypass it. A forgotten filter in the code still cannot read another workspace's rows.
Every read of a protected object goes through one access-aware function, and every write through one permission check. The browser, the API, the command line, the chat apps and the agents all use the same one. A forbidden object answers "not found", so its existence does not leak.
Every sensitive action writes an append-only audit row inside the same transaction as the change, naming who acted and through which channel. Rows are chained by hash, so a changed or deleted row breaks the chain. Verify it from the admin screen.
7c1e…a94fLinkede3b0…41d2Linked5f9a…0c7bLinkedb21d…9e60LinkedEvery inbound message from Slack, Teams, WhatsApp or Telegram is checked against the provider's signature, or for Telegram, which does not sign, its shared secret, before anything else, matched to a member, rate-limited, and run through the same permission check as a click. A message from someone we do not recognise gets nothing back, not even an error that confirms the workspace exists.
Nobody at OKR Institute can open your OKRGoal workspace through the product unless a workspace administrator grants a support session. The request names the person and the reason. A session lasts four hours by default and twenty-four at most, then ends by itself. While it is live, a banner on every screen, for every member, says who is in and for how long, with a button to end it. That banner cannot be dismissed. Direct access to the cloud's database is limited to the people who operate it.
There is no emergency override. We chose not to build one, because an override built "just in case" becomes the normal way in.
We would rather answer it properly than have you guess.