Designed into the model
- Customer-owned cloud and defined management scope
- Versioned plans and explicit change approval
- Separation of customer and workforce identity
- Tenant-specific access and evidence responsibilities
OWNERSHIP. ACCESS. EVIDENCE.
Trust Center
Confidence starts with knowing what is managed, who has access, and what is verified.
See it in the workspaceTRANSPARENCY FIRST
Design principles are not certifications.
OpenCentric is in development. This page describes the intended control model and what the current preview does and does not demonstrate.
Not established by this preview
- Live cloud connections or enforced production controls
- Independent compliance certifications or authorizations
- Verified availability or incident response commitments
- Production identity, billing, or customer data processing
RESPONSIBILITIES, MADE VISIBLE
Trust starts with a clear boundary.
An intended division of responsibility, to be confirmed in the service agreement before production onboarding.
| Area | Customer | OpenCentric |
|---|---|---|
| Cloud account & billing | Owns the account; pays the provider | Reviews eligible managed spend |
| Application & data | Owns code, business logic, and data | Supports separately agreed engineering |
| Platform changes | Approves the defined scope | Plans and manages agreed foundation changes |
| Security & assurance | Defines workload and regulatory obligations | Reviews gaps and evidence within scope |
| Offboarding | Retains account and application ownership | Hands over agreed artifacts; access is revoked |
CONTROL RESPONSIBILITIES
Questions worth making explicit.
Who owns applications and data?
The intended model keeps the cloud account, application code, business data, and product decisions with the customer. OpenCentric manages the platform elements explicitly included in the agreement.
How will access be granted?
Production onboarding is planned around scoped, revocable delegated access, not sharing root credentials. Customer and employee identities need separate trust boundaries and server-enforced tenant authorization. These integrations are not active yet.
Does OpenCentric certify my workload?
No. Architecture templates or security scans do not certify an organization or workload. Any applicable framework requires a defined scope, evidence, responsible owners, and the relevant independent assessment or authorization.
What data should I enter into the preview?
Use fictional, non-sensitive information only. Do not enter credentials, personal information, regulated records, or confidential project details. Demo metrics are illustrative, not production telemetry.
What needs agreement before production?
Management scope, access permissions, data handling, retention, incident responsibilities, recovery objectives, service commitments, commercial terms, and offboarding must all be defined and verified before live operation.