The agentic systems platform for
Enterprise-grade security and compliance

OutSystems platforms comply with HIPAA, PCI DSS, and FedRAMP requirements and hold certifications including SOC 2 Type II and multiple ISO standards. Built-in security and governance controls help customers build compliant applications out of the box. OutSystems also complies with privacy laws such as GDPR. See the OutSystems Trust Center for current details.

OutSystems can support HIPAA-regulated use cases for healthcare organizations and teams handling protected health information. Depending on the deployment model and customer requirements, OutSystems can support Business Associate Agreements and security controls for access, encryption, monitoring, and governance. Customers should confirm scope, responsibilities, and configuration requirements during compliance review.

OutSystems supports government and public sector use cases. The OutSystems platform is also FedRAMP-Moderate Authorized in a partnership with Knox.

OutSystems supports enterprise authentication methods, including SAML, OAuth, SSO, Microsoft Entra ID, formerly Azure AD, and multi-factor authentication via supported identity providers. The platform also includes accelerators for social/B2C logins (Facebook, Google, LinkedIn, Apple). This allows organizations to centralize access control, align applications with existing identity standards, and enforce consistent login and security policies on the platform and across applications.

OutSystems supports centralized user provisioning, role-based access control, and permission management across applications. Teams can define roles, assign access by user or group, and manage permissions as their application portfolio grows. OutSystems also allows customers to extend the built-in capabilities via user and access management REST APIs. This helps enforce least-privilege access, simplify administration, address specific provisioning and role management scenarios, and maintain governance across multiple applications and teams.

OutSystems encrypts data at rest by default and protects data in transit with TLS. Depending on the platform and deployment model, physical and logical separation and namespace segregation help keep customer data isolated. Included security libraries also support envelope encryption, allowing customers to add a second layer of protection for sensitive data.

Data residency depends on the customer’s selected region. OutSystems can support region-specific hosting requirements so organizations can keep application data in approved geographies. This is especially important for regulated industries with sovereignty, privacy, or country-specific compliance obligations.

OutSystems manages platform and infrastructure patching based on the deployment model. In ODC, one-click patching (1CP) reduces application-owner effort: customers are notified when patches are available, and the platform automatically builds and applies them the next time the application is published.

Yes. Customers can perform penetration testing on OutSystems applications, typically with coordination and approval to ensure testing follows platform policies and does not disrupt shared infrastructure. Security teams can also use third-party scanning tools and internal assessment processes to validate application security, compliance requirements, and production readiness.

During a Vendor Risk Assessment, OutSystems provides security documentation, compliance evidence, architecture details, data protection information, and responses to customer security questionnaires. Procurement, legal, and security teams use this process to evaluate risk, confirm controls, and verify that OutSystems meets organizational requirements before purchase or deployment.

Yes. OutSystems can integrate with security monitoring and observability tools such as Splunk, Dynatrace, New Relic, and SIEM or APM platforms. Teams can stream logs, monitor application behavior, and connect platform events to existing security operations workflows, helping maintain visibility across the broader enterprise monitoring stack.

OutSystems includes built-in monitoring capabilities for application health, errors, performance, access activity, and operational events. Teams can use native logs and dashboards to investigate issues, detect abnormal behavior, and support audits. For deeper observability, OutSystems can also connect with external monitoring, SIEM, or APM tools.

OutSystems helps protect sensitive data in AI use cases through agent guardrails, access controls, governed model connections, data boundaries, auditability, and configuration options that limit what information agents or AI features can use. Customers should define approved models, data handling rules, and review workflows to reduce leakage risk.

OutSystems supports AI security guardrails such as role-based access, governed tool access, monitoring, audit logs, and controls that help reduce risks like prompt injection, PII exposure, and unsafe outputs. Agent Evaluations also let teams test agent behavior against defined datasets and criteria, helping validate that agents perform as expected before and after deployment.

AI processing location depends on the selected model, provider, and deployment architecture. OutSystems can support governance patterns that help customers choose approved models, route requests through controlled endpoints, and align processing with regional or data sovereignty requirements. Teams with strict constraints should validate provider, hosting, and data residency options early.