Security / trust page — openstatus

Cited by

Facts read from this source

• Open source code Report an error

  “Every line of openstatus is on GitHub. You can read it, fork it, or open a pull request.”

• Self hosting Report an error

  “Don't want your data on our infrastructure? Run openstatus on your own — the self-hosting guide walks through it.”

• Public list Report an error

  “The full list of services we use to run openstatus.dev is public at /subprocessors — no NDA, no trust center login.”

• Https tls Report an error

  “All traffic to openstatus.dev and the API is served over HTTPS with modern TLS.”

• Encryption at rest Report an error

  “Data is encrypted at rest by our infrastructure providers — primary databases on Turso, analytics on Tinybird, application hosting on Vercel and Fly.”

• Secret handling Report an error

  “Integration credentials you submit (Slack bot tokens, OpsGenie keys, etc.) are stored encrypted in the database and stripped from audit log entries.”

• Auth methods Report an error

  “You sign in with GitHub or Google OAuth, an email magic link, or your company's SSO provider.”

• Passwordless auth Report an error

  “Account sign-in never involves a password, so there is none for openstatus to see or store.”

• API scoped keys Report an error

  “API access uses scoped keys: a key with the read scope can only call read-only endpoints; a key with the write scope can mutate data.”

• Workspace isolation Report an error

  “Every database read and write is filtered by workspace ID at the service layer — there is no shared state between workspaces.”

• Audit log Report an error

  “Every mutation in your workspace — whether it comes from the dashboard, the API, MCP, or the Slack integration — is recorded in an append-only audit log.”

• Audit log access Report an error

  “Workspace members on Pro can browse it at /settings/audit-logs in the dashboard.”

• EU default Report an error

  “We default to EU-hosted infrastructure wherever the provider offers it: queues on GCP (EU), analytics on Tinybird (EU), email on Resend (EU), product analytics on Openpanel (EU).”

• Global providers Report an error

  “Application hosting and the primary database run globally on Vercel, Fly, Koyeb, Railway and Turso.”

• Code review practice Report an error

  “PRs are reviewed by a human and by automated code review before merge. CI runs lint, type-check, and tests on every commit.”

• Public changelog Report an error

  “We publish a public changelog for every meaningful change to the product, so you can see what shipped and when.”

• Adr practice Report an error

  “Larger architectural decisions are written up as ADRs in the repo's /docs/adr folder, so the reasoning behind each one is on record.”

• Vulnerability reporting Report an error

  “We acknowledge reports within three business days and keep you informed until the issue is resolved.”

• Rfc9116 contact Report an error

  “The full disclosure policy is in SECURITY.md, and our RFC 9116 contact is at /.well-known/security.txt.”

• Integrations named Report an error

  “Integration credentials you submit (Slack bot tokens, OpsGenie keys, etc.) are stored encrypted in the database and stripped from audit log entries.”

Scores citing this record

• The Agency Developer API, monitoring as code & team administration
• The Agency Developer European sovereignty
• The Customer Support Lead API, monitoring as code & team administration
• The Customer Support Lead European sovereignty
• The E-Commerce Operations Manager API, monitoring as code & team administration
• The E-Commerce Operations Manager European sovereignty
• The SaaS Platform Engineer API, monitoring as code & team administration
• The SaaS Platform Engineer European sovereignty
• The Information Security Officer API, monitoring as code & team administration
• The Information Security Officer European sovereignty
• The Skeptic API, monitoring as code & team administration
• The Skeptic European sovereignty