Security
Security
A plain account of how this website, our hosted service, and the data flowing through them are protected. The open-source CLI runs inside your own CI and infrastructure, so when you use it on its own, your code and pipeline data never reach us. If you connect it to the hosted service, we receive only the evidence artifacts you choose to send, your account details, and what you enter in the dashboard.
Security practices
Application security
- A Content-Security-Policy, HTTP Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options: DENY, Referrer-Policy, and a locked-down Permissions-Policy are set on every response.
- Rate limiting on authentication, the product updates and contact forms, and repo chat sign-in, to slow down brute-force and abuse attempts.
- Origin-header verification (CSRF mitigation) on our API routes.
- Sign-in sessions use strictly-necessary, HttpOnly cookies that are never used for tracking or advertising.
Data handling
- All of this website's database queries go through Drizzle ORM with parameterized queries, no raw SQL string concatenation, so there is no SQL-injection surface in how this site talks to its database.
- Vercel Web Analytics on this site is cookieless: it sets no cookie and assigns no persistent visitor identifier.
- Full detail on what we collect and why, including every third party involved, is in our Privacy Policy.
Infrastructure
- This site is hosted on Vercel with HTTPS enforced end-to-end.
- Our database runs on Neon (managed Postgres).
- Repo chat calls Google's Gemini API server-side; your messages are never exposed to other visitors.
Hosted service
- The hosted service runs in the EU: on Vercel in Frankfurt (fra1), with its database on Neon in AWS eu-central-1 (Frankfurt).
- All traffic is encrypted with TLS, with HSTS enabled. Data at rest is encrypted by our hosting and database providers.
- Evidence artifacts sent from your CI are accepted only with a valid project API key.
- Sign-in is passwordless, by magic link, so we store no passwords.
- Role-based access (admin, member and viewer) and per-organisation access control are enforced in the application, and each organisation has its own audit log.
- Public and sign-in endpoints are rate limited, and strict security headers are set, including a nonce-based Content-Security-Policy and frame-ancestors 'none'.
- How we process your organisation's data is set out in our Data Processing Agreement, linked below.
Certifications
- We have not pursued formal certifications such as SOC 2 or ISO 27001 yet. We would rather say that plainly than leave the question unanswered.
- In their place, the open-source CLI and engine are AGPL-3.0-licensed and public on GitHub, so you do not have to take our word for how they handle your code. The hosted dashboard service is proprietary; its measures are listed above and in our Data Processing Agreement.
Found a vulnerability?
Please do not report it in a public GitHub issue. Follow our security policy and email security@opencomplai.com. Our security.txt and trust page have the contact details, data flow and sub-processors. For the full data-handling picture, see the Privacy Policy and, for the hosted service, our Data Processing Agreement.