Trust Center
Security & Compliance
At OpenHack, security is foundational to how we build and operate our platform. This page provides an overview of our compliance posture, security practices, and the third-party services we use.
Compliance frameworks
HIPAA
CompliantBusiness Associate Agreements available. OpenHack does not process PHI as a primary function but maintains HIPAA-aligned safeguards for healthcare customers.
GDPR
CompliantEU data protection rights honored. Standard Contractual Clauses available for international transfers.
SOC 2 Type I
In ProgressSecurity, Confidentiality, and Availability trust principles. Audit underway with an accredited CPA firm.
ISO 27001
In ProgressInformation security management system certification. Audit underway with an accredited certification body.
Security practices
Core controls used to protect customer data and operate the OpenHack platform.
Data Security
- Encryption at rest
- Encryption in transit
- Encrypted database backups
- Source code deleted after scans
Access Control
- Multi-factor authentication
- Least-privilege access
- Organization-scoped data access
- Periodic access reviews
Application Security
- Automated vulnerability scanning
- Dependency monitoring
- Web application firewall
- CI/CD security checks
Monitoring & Response
- CloudTrail audit logging
- CloudWatch monitoring
- Sentry error alerting
- Incident response procedures
Endpoint Security
- Full-disk encryption
- Automatic device locking
- Endpoint protection
- Secure remote-work controls
Business Continuity
- Multi-AZ production database
- Point-in-time database recovery
- Documented recovery procedures
- Defined recovery objectives
Data handling
Source Code
Customer source code is accessed read-only via authorized GitHub integrations. Code is downloaded temporarily for analysis and deleted after scan completion. OpenHack does not modify, fork, or retain copies of customer repositories.
AI & Model Training
Customer data is never used to train, fine-tune, or improve any AI models. LLM inference is performed via API calls that do not retain input data. OpenHack's AI analysis is stateless — no customer data persists in the inference pipeline.
Data Retention & Deletion
Scan findings are retained for the duration of the customer's subscription. Upon contract termination, all customer data is deleted within 30 days. Customers may request deletion at any time by contacting privacy@openhack.com.
Subprocessors
OpenHack uses a limited set of third-party subprocessors to deliver our services. We evaluate each provider's security practices and maintain contractual data protection obligations with every subprocessor.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure, compute, storage, database, logging | Source code (temporary), scan findings, application data, user account data | US (us-west-2) |
| OpenRouter | LLM inference for vulnerability analysis | Source code snippets (temporary, with Zero Data Retention and training restrictions) | US |
| Temporal Technologies | Workflow orchestration | Workflow metadata (task IDs, status, timestamps) | US |
| WorkOS | Authentication and SSO | User email addresses, organization info, session tokens | US |
| Stripe | Payment processing | Billing information (name, email, payment method) | US |
| PostHog | Product analytics | Anonymized usage events (feature usage, page views) | US |
| Sentry | Error monitoring | Error metadata, stack traces, request context | US |
| Resend | Transactional email | Email addresses, notification content | US |
| Cloudflare | DNS, CDN, and edge compute | Request routing metadata, static assets | Global (edge) |
| GitHub | Source control and webhooks | Source code (customer-authorized), webhook event metadata | US |
To subscribe to subprocessor change notifications, contact privacy@openhack.com.
Contact
For security questions, BAA requests, DPA inquiries, or to report a vulnerability: