Trust & Security

About

At Open, we prioritize your data security with top-tier infrastructure and stringent privacy standards, ensuring the utmost integrity in our services.

We adhere to industry-accepted standards to ensure your data’s security and compliance.

Security And Privacy

Data-center Protections

Physical security

Open products are hosted on cloud infrastructure platforms that hold SOC 2 Type II and ISO 27001 certifications, among other credentials. These certifications ensure robust security measures, including dedicated security personnel, stringent physical access controls, and comprehensive video surveillance.

Patch Management

Open’s patch management process identifies and resolves missing patches in the product infrastructure, ensuring software packages are up to date through server-level instrumentation.

Security Incident Response

Open’s security incident process flows, and investigation data sources are pre- defined through regular preparation activities and refined via follow-ups. We use standard incident response structures to ensure timely and appropriate actions.

Application security

In-transit Encryption

Sessions are protected with in-transit encryption using 2,048-bit or stronger keys and TLS 1.2 or higher. This ensures data integrity and confidentiality by encrypting data before transmission, authenticating endpoints, and verifying data integrity upon arrival.

Web Application and network firewalls

Open utilizes a comprehensive suite of tools to monitor potential attacks, including a web application firewall and a network-level firewall. Additionally, the platform incorporates Distributed Denial of Service (DDoS) prevention measures to protect and ensure uninterrupted access.

Software development lifecycle (SDLC) Security

Open ensures consistent software quality through static code analysis tools and human review processes. Our secure coding practices follow OWASP guidelines, and we conduct bi-annual application security assessments with third-party vendors. Additionally, Open performs Software Composition Analysis (SCA), generates Software Bill of Materials (SBOM), and utilizes Infrastructure as Code (IAC). We also enhance security through a comprehensive bug bounty program, refer https://open.money/legal/responsible-disclosure for more details.

Audits, Vulnerability Assessment & Penetration Testing

Vulnerability assessment

Open conducts quarterly vulnerability assessments on our network infrastructure to identify and mitigate potential security risks. These assessments ensure that our systems remain secure and compliant with industry standards.

Penetration testing

Open employs third-party penetration testing firms to conduct thorough security assessments of its products and infrastructure, ensuring the protection of customer data and systems.

External audit & certification

Open ensures compliance through regular external audits and certifications, demonstrating its commitment to security and operational excellence.

Resiliency and Availability

99.9% Uptime

Open consistently maintains a high availability rate of 99.9%, ensuring uninterrupted access to its services. Customer data is comprehensively protected through redundant online backups and regular snapshots, providing robust disaster recovery capabilities.

24x7x365 Monitoring

Open employs proprietary and industry-standard tools to monitor application, software, and infrastructure performance.

Data Center Redundancy

Open employs redundant failover systems to mitigate the impact of single points of failure, ensuring uninterrupted service continuity.

Disaster Recovery

Open maintains comprehensive data recovery procedures and robust application code backup strategies to ensure rapid restoration in the event of a data loss incident. Our point-in-time recovery capability allows us to restore data to any specific point within the last 35 days, minimizing downtime and business disruption.

Data Privacy and Data Access

Restricted access to Databases and data storages

Access to databases and data storage systems is strictly controlled and restricted to authorized executives within the organization.

No local or on-premises storage of data

Open utilizes Amazon AWS cloud infrastructure, with each environment operating within its own private network. We do not store customer information on any local or on-premise infrastructure, including development and testing environments.

Privacy Policy

Please refer our privacy policy here: https://open.money/privacy

PRODUCT SECURITY

• Role Based Access Control
• Audit Logging
• Data Security
• Single Sign-on
• Team Management

REPORTS

• Compliance Reports
• Vulnerability Assessment and Pen testing Reports
• Application Security Reports
• Source Code and SCA Reports
• Configuration Assessment Reports

DATA SECURITY

• Access Monitoring
• Backups
• Encryption-at-rest
• Encryption-in-transit
• Physical Security

APP SECURITY

• DAST and SAST Analysis
• Software Development Lifecycle
• Vulnerability & Patch Management
• API Security
• Application Performance Monitoring (NOC)

ACCESS CONTROL

• Data Access
• Logging
• Password Security

INFRA SECURITY

• WAF
• AWS Security Services
• BCP/DR
• Infrastructure Security
• Attack Surface Management

ENDPOINT SECURITY

• Disk Encryption
• Endpoint DLP
• Mobile Device Management
• Endpoint Detection & Response

NETWORK SECURITY

• Firewall
• Spoofing Protection
• Traffic Filtering
• Network Segregation
• DNS Filtering
• Threat Detection

ORG SECURITY

• Email Protection ( PAB)
• Employee Training and awareness
• Incident Response (SOC)
• Brand Monitoring
• Single Sign-on

POLICIES

• Business Continuity Policy
• Data Security Policy
• ISMS Policy
• Incident Response Policy
• Other Policies

Note: Reports/ Certificates/ Evidence can be provided based on the request