Security

What's actually verified, and how to report a problem.

Verified controls

✓Role-based access (Admin/Member/Viewer) enforced server-side on every request, not just in the UI.
✓Row-level tenant isolation — authorization and resource ownership are checked server-side and refreshed from current membership.
✓Inbound webhooks are HMAC-signed; the shared secret is shown once and never stored in plaintext logs.
✓Provider API keys (AI connections, integrations) are stored encrypted and write-only — never displayed back after entry.
✓Self-hosted deployments run on infrastructure you own (your own Vercel + Supabase project); OpenTechnologyApp never has access to a self-hosted instance's data.

What we don't claim

We don't hold SOC 2, ISO 27001, or HIPAA certification, and we haven't published third-party penetration test results. We don't publish an uptime or support-response SLA. If any of those matter for your evaluation, ask before you buy — don't assume.

Report a vulnerability

We don't yet have a dedicated security inbox. If you find a vulnerability, use the support form — put "Security" at the start of your message and include steps to reproduce. Please don't test against other customers' data, and give us a reasonable window to fix an issue before disclosing it publicly.

Self-hosted deployments: the controls above describe the hosted service. A self-hosted instance runs on infrastructure you own and secure — see self-hosting for operator responsibilities.