PlatformTrust & infrastructure

Built to be trusted with your files

OCA Drive runs on servers we own and operate in our own data centers, not on a rented public cloud. Here is how we keep every organization's data separate, encrypted and safe.

OCA Drive platformAll systems operational

Edge

Load balancers · TLS 1.32 sites

App servers

api-01metadata
api-02metadata
api-03metadata
gateway-01blocks
gateway-02blocks
gateway-03blocks

Storage servers

vol-0116 TB
vol-0216 TB
vol-0316 TB

State

PostgreSQLprimary + replica
Event bus3 nodes

Storage pool

48TB

3 storage servers · 48 TB

Every organization in its own space

Your files, folders, links and audit history belong to your organization and nobody else. Every request is checked against the organization it comes from, so one customer can never reach another's data.

  • Isolation enforced on every request and every database query
  • Separate storage namespaces per organization
  • Our staff access is limited, approved and recorded in the audit log
Organization isolation
Enforced
Al-Noor Clinic
isolated
Nakhla Studio
isolated
Qamar Trading
isolated

Each organization's files stay inside its own space.

Stored more than once, backed up every day

Each block of every file lives on several storage servers at the same time. If a disk or a whole machine fails, your files stay available and missing copies are rebuilt automatically.

  • Replication across servers and racks
  • Daily encrypted backups to a second site
  • Point-in-time recovery for metadata
Block placement
2+ copies
vol-01
vol-02
vol-03

Each block lives on at least two different servers.

Protected at every step

Data is encrypted on the way to us and while it is stored. Sign-ins can require passkeys or a second factor, and every upload is scanned before anyone can open it.

  • TLS 1.3 in transit, AES-256 at rest
  • Passkeys, two-factor and SSO for business plans
  • Malware scanning and ransomware rewind
Protection at a glance
On by default
  • Encryption in transitTLS 1.3
  • Encryption at restAES-256
  • Backupsdaily · off-site
  • Public cloud providersnone
  • Selling or sharing your datanever

Compliance roadmap

Saudi PDPL

Processing aligned with the Personal Data Protection Law, with data hosted in the Kingdom.

Data processing agreement

A standard DPA for business customers that defines how we process your data.

ISO/IEC 27001

Information security management certification is on our roadmap.

SOC 2 Type II

An independent audit of our security controls is planned after launch.

Keep exploring

Start with a free account

Create your drive in a minute, install the apps on every device, and upgrade when your team grows.