Enterprise

Security

What OneOS does for every request, every key and every secret, as built today.

In transit

Every endpoint is HTTPS. os.one.ml sends Strict-Transport-Security: max-age=63072000; includeSubDomains; preload.
The SDK, CLI and MCP server refuse a plain http:// gateway except on loopback.
The gateway runs on Google Cloud Run in us-central1.

Credentials

One credential per request, in one Authorization header; requests with more than one are refused.
Every credential is verified with One account on every request. A revoked key stops working within about a minute.
API keys carry explicit scopes, an optional expiry, and are shown once at creation. Only organization owners and admins can create, rotate or revoke them, and only with scopes their own role holds.
Keys can be created straight into Blinds custody (genesis keys create --blinds), so no person sees the raw value.
The CLI stores a signed-in session in the operating system's keychain.

Isolation

The gateway forwards each request with a signed identity (organization, principal, scopes, method, path and time) that the service verifies. A service acts only in that organization.
Required scopes are checked at the gateway before a request reaches a service.

Secrets and sensitive values

Hives secrets and environment values are encrypted with Genesis KMS. Listing returns names and versions only.
Revealing a value is a separate, explicit operation, and each reveal is recorded in the project's activity: reveal a secret, reveal an environment value.
Blinds holds credentials for agents and delegates them narrowly, with consent decisions an owner approves or denies: Blinds.

Activity and audit records

Record	Operation
Project activity (Hives)	`hives_get_project_activity`
Credential custody and consent (Blinds)	`blinds_listActivity`
Workflow meter, audit and evidence records (Gears)	`gears_listOperationalRecords`
Context meter, audit and evidence records (Lanes)	`lanes_listOperationalRecords`
Signed run receipts (Henry, Fleets)	`henry_getRun`, `fleets_getTaskReceipt`
Usage events (Traces)	`traces_listUsageEvents`

Every response carries an x-request-id; send your own UUID v4 in X-Request-Id to join your logs to ours.

The Console at os.one.ml sends a strict Content Security Policy (scripts from its own origin only, no framing), X-Frame-Options: DENY, X-Content-Type-Options: nosniff and a strict-origin-when-cross-origin referrer policy.

One Superintelligence, Inc. · Built from Genesis 0.1.12 and the live gateway on 2026-10-20. Support