Security

Your labs stay on your hardware.

OML is self-hosted by design. This page describes the architecture we've actually built — not a compliance certification. If you need something this page doesn't answer, email us directly.

Self-hosted, on your network

OML runs entirely on hardware you control — your laptop, a rack server, or a VM on your own LAN. Topologies, node configs, packet captures, and console sessions are all stored and processed locally on your appliance. None of that ever needs to reach omllabs.com to function. The only outbound calls OML makes to license.omllabs.com are for license activation/validation and checking for OTA updates — both of which can be pointed at an offline/air-gapped workflow if your deployment requires it.

Local AI, by default

The built-in Neto AI tutor and lab assistant run on Ollama, hosted on your own appliance — your configs and questions never leave your network. An optional Claude API fallback is available if you choose to enable it and provide your own API key; it is never required and never enabled by default.

Authentication

Password storage

Passwords are hashed with bcrypt — never stored or logged in plaintext.

Sessions

JWT-based session tokens, issued per login, scoped per account.

Two-factor auth

Optional TOTP-based 2FA (authenticator app codes) can be enabled per account.

SSO options

Google OAuth is supported for sign-in; Enterprise plans add SSO/LDAP.

Updates & license integrity

Signed OTA updates — update bundles are Ed25519-signed at build time; your appliance verifies the signature and checksum before applying anything, and automatically rolls back if a post-update health check fails.
Licensing — license tokens are cryptographically signed (RSA-PSS) by our license server, not something a client can forge locally.
Appliance hardening — the official OVA ships with a locked-down, shell-less console (F2 for network config, F12 for power), an EULA/vendor-image acceptance gate on first boot, and a GRUB-recovery password so the boot chain can't be casually bypassed on physical/console access.

Network & TLS

OML supports bringing your own TLS certificate for HTTPS access to the appliance, so you're not stuck on a self-signed cert if your environment requires a trusted chain. The platform is designed to work fully air-gapped once activated — network egress to license.omllabs.com is only needed for activation and optional update checks.

What we collect on omllabs.com

Creating an OML Labs account collects the basics needed to run a license: name, email, username, and a hashed password. We do not collect or transmit your lab topologies, node configurations, or console activity — those live on your own appliance. If you explicitly publish a lab to the Community library, that specific lab (and only that lab) is what gets shared.

Found a vulnerability? We don't yet run a formal bug-bounty program, but we take reports seriously — email [email protected] with details and we'll respond directly. Please give us a reasonable window to fix an issue before any public disclosure.

Questions about a specific deployment or compliance need? [email protected]