Your evidence never leaves your network
Corvex-RedOps is a security tool built to be trusted by the teams that run it. This is how it is deployed, what data stays on your infrastructure, and how issues are handled.
Deployment
Corvex-RedOps is self-hosted. You run it on your own hardware or private cloud, online or fully air-gapped. There is no mandatory SaaS component and no phone-home for the engine to function.
Data flow
Scan targets, findings, evidence and reports stay on the infrastructure you run it on. The out-of-band callback server used during safe validation is one you host, so validation traffic never leaves your network. The full telemetry statement is published in the repository and will be mirrored here with the first release.
Safety controls
- Scope enforcement, time windows and per-host rate limits enforced in code.
- An append-only audit log of every action.
- Non-destructive validation by default; active checks are opt-in and approved by the operator.
Software supply chain
The Community edition is open and inspectable under Apache-2.0. Releases ship with third-party notices and a software bill of materials (SBOM). Signed releases are on the roadmap.
Responsible use
Corvex-RedOps is for authorised testing only. Using it against systems you do not own or have explicit written permission to test may be illegal. See the acceptable-use policy.
Vulnerability disclosure
Security issues in Corvex-RedOps itself can be reported under our coordinated disclosure policy. A security.txt is published, and reporters are credited.
Compliance roadmap
Reports map findings to OWASP, PCI DSS, ISO 27001 and MITRE ATT&CK today. Formal compliance attestations for the project will be published here as they are completed, with dates — never claimed before they exist.