osquery: ask every endpoint a question in SQL
What osquery is, how its tables and daemon work, 10 copy-paste queries for inventory, access and compliance, and the tools that run osquery at scale, from Fleet to CrowdStrike Falcon for IT.
Trust Center
Security, privacy and AI governance.
Checking monitoring status
Compliance
Frameworks we are audited against, and what is next.
SOC 2
An independent audit confirming a company keeps customer data secure, available, and private.
22% complete
NIST CSF 2.0
The U.S. government's widely used framework for identifying, preventing, and recovering from cyber threats.
Planned
CMMC 2.0
The U.S. Department of Defense's cybersecurity standard for contractors that handle defense information.
Planned
Controls
Security controls currently passing in continuous monitoring (via Vanta).
5 passing controls in Identification & authentication
Production application access restricted
System access restricted to authorized access only
Production database access restricted
The company restricts privileged access to databases to authorized users with a business need.
Production network access restricted
The company restricts privileged access to the production network to authorized users with a business need.
Remote access encrypted enforced
The company's production systems can only be remotely accessed by authorized employees via an approved encrypted connection.
Unique network system authentication enforced
The company requires authentication to the "production network" to use unique usernames and passwords or authorized Secure Socket Shell (SSH) keys.
Documents
Public documents open directly. Gated documents are shared under NDA after one short request.
Privacy policy
Public
Subprocessors
Third parties that process customer data on our behalf.
Cloud provider
Identity provider
Security
Underlying LLM Model
Underlying LLM Model
Underlying LLM Model
AI & data use
How customer data is handled by the AI in our products.
What prevents the AI from taking unsafe or unapproved actions on our environment?
OpenFrame ships a completed AI Guardrails system enforcing safety policies, prompt-injection protection, output validation, action-impact assessment, and rate limiting on sensitive operations with human-in-the-loop controls for high-impact changes.
Does your AI train on our data?
No. Customer data submitted to our AI features is used only to service that customer's own requests. It is not used to train underlying models or shared across tenants.
Are AI interactions logged, and can we audit what the AI did and why?
Yes. Every AI action is recorded in the activity logs, which capture the status, tool used, source, and full details of each execution, including a direct link to the specific device the action ran on. Logs are searchable and filterable by status, tool, and source, so you can trace exactly what the AI did, when, and why, whether you're verifying an automated fix, confirming a script ran as intended, or investigating an unexpected change.
Does the AI have access to data outside our tenant?
No. Every AI interaction is scoped to your individual environment. Fae and Mingo only ever access the data belonging to your organization. There is no cross-customer data access at any layer, including AI.
Does a human need to approve an action before it is taken by the AI?
Yes. Both Fae and Mingo will always ask for approval before making any changes to a device. They can gather information and propose a fix, but nothing is executed without a technician (or user, depending on your guardrail settings) confirming it first. This is enforced by design, not left to the AI's discretion.
Contact
Security questions
Customers and prospective customers can reach our security team for questionnaires, documentation or a review call.
What We Promise
Open by Design
All our code will be open-source. No hidden features, no vendor lock-in, no surprises.
Built with MSPs
Every feature developed with real MSP feedback. Your needs drive our roadmap.
Documented Process
From development to deployment, we document everything. Full transparency in how we build.
Enterprise-Ready Security
We create our own secure versions of OSS projects with enforced security practices for coding and authentication.
Commercial Stability
Backed by serious investors as a commercial company committed to long-term support and development.
Coming soon
Compliance Focused
SOC 2 Type II compliance coming soon. Enterprise-grade security standards.
The Problem We're Solving:
Current MSP Pain Points:
Expensive vendor licensing eating profits
Closed-source tools hiding functionality
Complex integrations requiring custom work
Limited control over critical infrastructure
Our Solution:
Open-source MSP platform that puts control back in your hands while reducing costs.
Trusted by Fortune 1000
Secured by Transparency:
The same open source technology that powers Google, Microsoft, and your bank.
Transparent Security
More eyes is better. Community catches flaws faster.
Zero backdoors possible when code is public
3x fewer zero-day exploits vs proprietary software
Immediate fixes vs hidden vulnerabilities
Enterprise Proven
78% of enterprise containers run on Kubernetes (OSS)
66% of web traffic secured by OpenSSL (OSS)
Microsoft uses open source in their own security tools
$1 trillion+ daily transactions trust open source encryption
Building in the Open
OpenVAS vulnerability scanner for IT teams and MSPs: what the free edition covers, how to run it and how it compares
What the OpenVAS vulnerability scanner is in 2026, what Greenbone's free Community Feed still covers after its 2026 cutback, how to run it with Docker, its licenses and how it compares with Nessus.
How to install OPNsense: default logins, first setup and hardening for IT teams and MSPs
The OPNsense installer password and every default login, a verified 26.7 install on hardware or a VM, the console menu, first setup and the hardening IT teams and MSPs do before go-live.
Vaultwarden for IT teams and MSPs: what it is, how it compares to Bitwarden and how to run it safely
What Vaultwarden is, where the official project lives, how it compares to Bitwarden, its 2026 security record, and the setup, backup and patching checklist for running it at work.
13 free and open source Active Directory management tools
Thirteen free and open source Active Directory management tools sorted by job: Microsoft RSAT and PowerShell for daily admin, AD Explorer, OpenRSAT and LDAP editors for browsing, PingCastle and BloodHound CE for security audits, and Samba as a Linux domain controller, with each license and the PingCastle catch for MSPs.
It's Already in Your Life:
Your banking app is secured by open source encryption
Your cloud storage is powered by Linux infrastructure
Your streaming service is delivered via open source CDNs
Your mobile phone is built on open source frameworks
Open source isn't experimental-it's the essential infrastructure powering the digital world. If it's secure enough for your bank, it's secure enough for your MSP.
OpenFrame Github
Perfect for MSPs who want full control and zero vendor lock-in.
FAQ
/trust-center
Security & Access Control
Do you support Single Sign-On (SSO) for our team?
Yes. Your team can sign in with Microsoft (Azure AD) or Google, and you can run both at the same time. No extra passwords to manage, and access follows your identity provider.
Do you enforce multi-factor authentication (MFA)?
Yes, MFA is enforced as part of the Azure AD SSO integration.
How do you control remote access to our clients' devices?
You decide, per device or group. Remote sessions can require the end user's approval, notify them without blocking, or run silently. Settings cascade from global to organization to device group to device to technician role, so you can lock down sensitive clients and keep the rest flexible. End users get an on-screen connection indicator with consent and disconnect controls.
Is the end user notified when a technician initiates a remote session on their device?
Yes. OpenFrame provides transparent session notifications for both attended and unattended remote access. The end user is notified when a technician connects to their device.
Data Handling & Infrastructure
Is our data hosted on your infrastructure, or can we self-host?
You can do either: OpenFrame is available as a self-hosted deployment (you control the infrastructure and data location entirely) or as OpenFrame SaaS. For self-hosted deployments, you are responsible for your own infrastructure security.
Where is our data stored?
Our data is stored in the United States. Flamingo is headquartered in Miami, and all customer data resides on US-based infrastructure.
What happens to our data on offboarding?
Your data is exportable, so there's no lock-in at renewal. If you disconnect Google Workspace or Microsoft 365, we delete the directory data synced from it. For Google, we also revoke our access grant. For Microsoft, removing the OpenFrame app from your Entra portal cuts off access completely, because we never hold a credential of yours. Backup copies may stick around for a limited period after deletion.
Do you encrypt data at rest?
All data sits on GCP persistent disks, which Google
encrypts by default with AES-256.
Do you encrypt data in transit?
Нes. TLS on every connection: to the database, between
services, and to all external APIs
Still deciding?
Ask Mingo answers from our docs and customer stories.