FOR THE REVIEWER WHO HAS TO SIGN OFF
Where everything lives, in plain terms.
Your data, your record and the workspace's app secrets sit in your Azure subscription. A few things sit on Fathym's platform. This page says which, and why.
New to OpenX? Key terms →
WHERE IT LIVES · AT A GLANCE
- Device data
- Your subscription
- Database data
- Your subscription
- Provenance
- Your subscription, locked in production
- App secrets
- Your landing zone's Key Vault
- Configuration
- Fathym's platform, secrets by reference
The full list is below.
WHAT OPENX REFUSES
The guard rails built into the code.
No secret without your vault
Saving a credential without a landing zone is refused. It never falls back to Fathym's vault.
No secrets in AI proposals
A proposal from an agent that carries a password, key or secret is refused.
API keys we never keep
Only a key's id, owner and dates are stored. A revoked key is refused on its next call.
A record nobody can reword
Provenance ignores an identity sent by the caller and uses the signed-in one. Records are written once and never overwritten.
A fresh sign-in where it matters
Signing a record (when you turn it on), accepting a change to a job identity, and accepting a proposal to lift delete protection.
Read-only for AI tools
An AI over MCP can call only the API routes marked read-only.
IF YOU ARE THE ONE HOLDING THE QUESTIONNAIRE
For the people who ask the hard questions.
Security reviewers
A straight answer to "where does it live?" for each kind of data and secret.
Cloud and IT teams
The resources OpenX builds sit in a subscription you can open and inspect.
Compliance leads
Records in your own storage, and a compliance matrix that says what is recorded today, and what is not.
WHAT SITS WITH FATHYM, AND WHY
Some things sit with us. We say which.
The workspace's configuration, licence records, API and MCP key records, and the short-term memory of Azi, OpenX's built-in assistant, live on Fathym's platform. So does the cloud connection's own key: it is held in Fathym's vault on purpose, because it is the key that opens yours.
- Credentials inside the configuration are references, or hidden when read.
- Azi's conversation memory is kept for seven days.
- On a subscription Fathym manages, your resources sit in a subscription Fathym owns and pays for. Bring your own and they sit in yours.
THE FULL LIST
Each kind of data, and where it lives.
| WHAT | WHERE IT LIVES | WORTH KNOWING |
|---|---|---|
| Device data and history | Your subscription: IoT Hub and Azure Data Explorer | Before your own IoT is set up, test messages pass through Fathym's shared hub, with no history kept. |
| Database data | Your subscription: Azure Cosmos DB | Protect from deletion adds an Azure delete lock on the account. |
| Provenance records | Your subscription: create-only storage | Locked as immutable in production. |
| Logs | Your subscription: Log Analytics and Application Insights | Built with the landing zone. |
| App secrets | Your landing zone's Key Vault | Relay passwords, Stripe keys, connection keys and app keys, kept by reference. |
| Job credentials | Your directory | No secret exists: a public certificate or a federated credential. |
| Cloud connection key | Fathym's Key Vault | It is the key that opens your vault, so it cannot live inside it. |
| Workspace configuration and licence records | Fathym's platform | Secrets inside it are references. |
| API and MCP keys | Not stored | Fathym keeps each key's id, owner and dates, not the key. |
| Azi's memory (OpenX's assistant) | Fathym's platform | Kept for seven days. |
For a workspace on a subscription Fathym manages, "your subscription" is the one Fathym created for it.
MOMENTS A REVIEWER CARES ABOUT
From the first review to the last day.
The security review
- 01Open the subscription and see the resources OpenX built.
- 02Check the Key Vault holds the app secrets.
- 03Read the list above for everything else.
A key that got out
- 01Someone pastes an API key where they should not.
- 02You revoke it.
- 03Its next call is refused.
If you leave
- 01You stop using OpenX.
- 02Your storage and its records stay where they are.
- 03On a subscription you bring, they stay yours.
WHERE REVIEWS RUN DEEPEST
Built for the strictest reviews.
LIFE SCIENCES
Records in your own storage, mapped against ALCOA++ in the docs.
MANUFACTURING
Plant data under the company's own Azure policies.
ENERGY AND UTILITIES
Meter and site data under the utility's own cloud policies.
Bring us your questionnaire.
We would rather answer the hard questions up front.
MORE OF OPENX
AI governance →
Over MCP, AI proposes and a person accepts. Only a person deploys.
OpenX MCP Server →
A few tools let any MCP-capable AI read your workspace and propose changes to it.
API Manager →
Your workspace is already an API. Decide who may call it and what each caller reaches.
Warm queries →
Save a question over live data and serve the answer to dashboards, apps and AI.
Provenance →
A record you can prove, kept in your own cloud, with corrections and signatures.
Your cloud →
Connect your Azure, build the landing zone, and the rest of OpenX runs inside it.
Databases →
A Cosmos DB store in your subscription, with a governed API for each container.
App Identity →
Your own sign-in directory, identities for your jobs, and access in one window.
Licenses →
Sell what you build on your own Stripe, and turn a subscription into a plan's rights.
IoT →
IoT Hub and Data Explorer in your Azure, feeding queries, APIs and AI.
Communications →
Send mail through your own relay, with the password in your vault and sends on record.
App building →
Data, sign-in, access, an API and billing: your app's backend, already there.