Oxidize Reviews & Product Details

Oxidize is a zero trust security platform for company-issued employee devices, from Oxidize Labs Inc. at oxd.sh. 39 security modules run from one endpoint agent and one console, and enforcement is agentic: every control starts in observe mode, learns a baseline from your own traffic, promotes itself to enforcement once validated, and stands itself back down when live false positives rise. Administrators pin or override any control, and every action is policy-scoped, reversible, and audited. That enforcement covers AI agents, not just people. Oxidize discovers shadow MCP servers, controls what coding agents and AI tools send outbound through an authenticated egress path, governs the non-human identities they run as, and detects prompt injection in inspected traffic. Capabilities: - Zero trust access: per-application, evaluated against identity, device posture, and network conditions, with a kill switch that fails closed when the tunnel drops. - Secure web gateway and CASB, DNS filtering including DoH and DoT, and network-path DLP with OCR, exact data matching, and fingerprinting. - TLS inspection, applied only to destinations matching your policy and only on devices that trust your organization CA. - Email security: business email compromise, impersonation, and phishing detection for Microsoft 365 and Google Workspace. - Endpoint response: kill a process, isolate a host, quarantine a file. Remote browser isolation for risky sites. - Compliance evidence for SOC 2, ISO 27001, HIPAA, PCI DSS, NIST 800-53, GDPR, and CIS Controls, assessed from live telemetry. Oxidize produces evidence; it does not certify your organization. How it works. The agent builds an encrypted tunnel, OxTunnel, to a regional Oxidize relay, where policy, inspection, and detection run inline in a single pass rather than through a chain of third-party proxies. OxTunnel is not a WireGuard derivative: ChaCha20-Poly1305 with the header and connection ID authenticated, a hybrid post-quantum handshake combining X25519 with ML-KEM-768, and relay identity signed with both Ed25519 and ML-DSA-65. The datapath is first-party, the relay uses AF_XDP kernel bypass on supported network cards, and the detection models are trained and signed by Oxidize, so a model update that fails signature verification never loads. Inbox security sits in the same platform, where comparable secure service edge products sell email separately, as an add-on, or through a partner. Scope. Windows, macOS, and Linux. iOS and Android clients are built and pending release approval, so they are not yet installable. Trials stay observe-only. Best fit: 100 to 10,000+ employee organizations whose staff run AI tools, coding agents, and MCP servers on company devices, and security teams consolidating point products onto one agent and one console. Pricing: per active user per month. Bandwidth, relay capacity, and management API calls are not billed separately, and one user covers unlimited devices.