Responsibility Matrix

1. Private processing

Private processing is off by default. You choose per scan whether to use it. With private processing, your file is deleted after it is analysed, and the scan results are available only to the owner of the API key, or to the organisation the owner is part of. Your sample sharing setting then no longer matters: the file is not shared with anyone. To have private processing enforced for all your scans, raise a ticket with OPSWAT Support (paying customers).

Without private processing, OPSWAT keeps your file and makes its results visible to other users of MetaDefender Cloud. With private processing, OPSWAT deletes your file after analysis, limits the results to the owner of the API key or their organisation, and does not share the file.

n/a

2. Where your files are processed

MetaDefender Cloud sends your file to the region you are in. If OPSWAT has no deployment in your region, your requests are routed to US West. To choose a region yourself, send your requests to that region's endpoint, for example api-prod-eucentral1.metadefender.com for Germany. The regional endpoints are listed on the Locations page.

Your files are processed and stored in the region you send them to and are not moved to another region.

AWS operates the data centres in each region.

3. Sample sharing

Sample sharing is enabled by default. If you keep it enabled, OPSWAT may share your file with the malware research community or its internal malware research team to investigate it further, in particular when the file is considered a false positive or potential outbreak malware. If you are a paying customer, you can disable sample sharing for a scan; the file is then deleted immediately once the analysis is done. If you use private processing, your file is never shared, whatever this setting says.

OPSWAT shares a file only while sample sharing is enabled for it and private processing is not used.

n/a

4. Multi-factor authentication

Nothing to turn on: multi-factor authentication is required for every user. If your organisation signs in through its own identity provider, OPSWAT's multi-factor authentication is disabled for those users, and enforcing it is your identity provider's job.

Since Jun 17, 2026 OPSWAT requires multi-factor authentication for all users, except those who sign in through their organisation's own identity provider.

n/a

5. API keys

You keep your API keys secret and ask for rotation or revocation when you no longer need a key, when the person who created it leaves, or when you suspect it has been exposed. Keys do not expire, so rotation is on your schedule.

OPSWAT rotates or revokes a key at your request through Support: it verifies that you are authorised, revokes the key and, for a rotation, delivers the replacement through a secure channel. To confirm a revoked key no longer works, call the API key information endpoint with it; it returns 401 Unauthorized. If you remove a user from your organization, their key keeps access to the results it submitted until you ask for it to be revoked. Request revocation whenever you remove a user.

n/a

6. Users and roles

Your administrator adds and removes users and gives each one a role. MetaDefender Cloud has three: Administrator, who can add other users, create sub-organisations and set their limits, change your security policies, scan files and view scan results; User, who can scan files and view scan results; and Analyst, who can only view scan results. A person must be registered with OPSWAT before you can add them. If you manage users in your own identity provider, disabling them there does not remove them from MetaDefender Cloud: you also remove them here and request revocation of their keys.

OPSWAT provides the Administrator, User and Analyst roles, described in , and applies them to every request.

n/a

7. Single sign-on, IP allowlisting, mutual TLS

IP allowlisting: your administrator adds the IP ranges allowed to call the API for your organisation, under Security Rules (availability depends on your licence). Single sign-on: you open a support case and provide your identity provider's SAML metadata and attributes; once enabled, OPSWAT's multi-factor authentication is disabled for your users. Mutual TLS (enterprise licence): you send OPSWAT your TLS certificate, with the whole chain of trust if it comes from your own certificate authority, and then include your certificate and private key in every request to the dedicated endpoint OPSWAT gives you.

OPSWAT enforces the IP ranges you set, confirms and enables your single sign-on integration, and, for mutual TLS, loads your certificate and sets up a dedicated endpoint for your organisation that accepts only requests carrying your certificate and private key.

n/a

8. When your contract ends

You ask OPSWAT Support to close your account through the Data Subject Request form, and export the data you want to keep before your request is processed. You can export your scan history, scan results and sanitized files from the last 24 hours, in JSON format, through the API.

OPSWAT deletes your files, scan results, scan history, private file hashes and organisation records from the live service and from backups in accordance with applicable laws, within the period that applies to your country or state, and tells you when deletion is complete. If you do not ask for deletion, OPSWAT keeps your files, scan results and scan history for up to 10 years from the date they were submitted, then deletes them.

AWS disposes of the physical storage media.