OpenCrowd Trust Center
Transparency about how OpenCrowd handles security, data, compliance posture, and responsible disclosure.
Security Posture
| Area | Status | Details |
|---|
| Open source | Ready | AGPL-3.0 source code transparency. |
| Self-hosted | Ready | Governance data remains in your infrastructure. |
| Encryption in transit | Ready | TLS 1.2+ for production HTTPS deployments. |
| Encryption at rest | Deployment controlled | PostgreSQL storage can run on encrypted volumes under your control. |
| Authentication | Ready | Keycloak with OIDC/PKCE and MFA support. |
| Brute-force protection | Ready | Configurable lockout policies through the identity layer. |
| Session management | Ready | Token expiry and idle timeout controls. |
| Audit logging | Ready | Governance actions are logged with actor, timestamp, and details. |
| API protection | Ready | Rate limiting, strict CORS allowlist, and security headers for production deployments. |
Data Handling
| Question | Answer |
|---|
| Where is data stored? | In your PostgreSQL database, on your infrastructure. |
| Does OpenCrowd phone home? | No telemetry and no usage tracking by default. |
| Does data leave the server? | Only when syncing governance changes to your connected applications. |
| What about Kai AI? | Kai is a future/optional module. When enabled, governance questions can be sent to Mistral AI in France; raw user data should not be sent. |
| Can OpenCrowd access my data? | No. Self-hosted deployments are controlled by the customer. |
| GDPR data export? | Tenant data export is part of the governance roadmap and product design. |
| Data deletion? | Customer administrators control deletion/reset procedures in their deployment. |
| Multi-tenancy isolation? | Schema-per-tenant PostgreSQL architecture for tenant separation. |
Compliance
| Framework | Status | How OpenCrowd Helps |
|---|
| GDPR | Ready by design | Self-hosting, customer-controlled data, export design, and deletion controls. |
| ISO 27001 access control | Assessed | Access control evidence, reviews, lifecycle governance, and audit logs. |
| SOX ITGC | Assessed | Audit trail, access reviews, approval workflows, and evidence gathering. |
| NIS2 | Assessed | Access governance, MFA support, incident-aware auditability, and privilege control. |
| Digital sovereignty | Core principle | Self-hosted deployment, open-source foundation, and no forced foreign cloud dependency. |
Infrastructure
| Component | Technology | Purpose |
|---|
| Backend | Kotlin + Spring Boot 3 | REST API and business logic. |
| Frontend | React + TypeScript | User interface. |
| Database | PostgreSQL 16 | Governance data storage. |
| Cache | Valkey | Performance cache. |
| Authentication | Keycloak | Identity, roles, MFA, and OIDC. |
| AI | Mistral AI | Optional/future governance assistant. |
| Deployment | Docker Compose / Kubernetes | Container orchestration. |
Security Testing
| Test Type | Frequency | Tooling |
|---|
| Automated security scan | Planned weekly | OWASP ZAP through CI. |
| Dependency vulnerability scan | On build | Gradle, npm audit, and dependency checks. |
| End-to-end tests | On commit | Playwright test coverage. |
| Load testing | Planned weekly | k6 load testing. |
| Penetration testing | Before major releases | Manual and automated validation. |
Access Control
| Control | Implementation |
|---|
| Role-based access control | Admin, Manager, User, and specialized roles with granular permissions. |
| Least privilege | Users see and manage only what their role allows. |
| Session timeout | Configurable idle and maximum session duration. |
| MFA | Supported through Keycloak using TOTP or WebAuthn. |
| IP allowlisting | Configurable per deployment in enterprise environments. |
| API authentication | OAuth 2.0 bearer tokens using JWT. |
| SCIM authentication | Bearer token per identity provider. |
Supply Chain
| Component | Source | License |
|---|
| OpenCrowd | OpenCrowd source repository | AGPL-3.0 |
| Keycloak | Red Hat / CNCF ecosystem | Apache 2.0 |
| PostgreSQL | PostgreSQL Global Development Group | PostgreSQL License |
| React | Meta | MIT |
| Spring Boot | Broadcom / Spring ecosystem | Apache 2.0 |
| Mistral AI | Mistral AI, Paris | Commercial API for optional/future AI module |
OpenCrowd is designed around open standards, self-hosted deployment, and a low lock-in architecture.
Responsible Disclosure
Found a security vulnerability? Contact security@opencrowd.io.
- We aim to acknowledge reports within 24 hours.
- We aim to assess and respond within 72 hours.
- We credit reporters in release notes with permission.
- We do not pursue legal action against good-faith security researchers.
Certifications & Roadmap
| Certification | Status |
|---|
| SOC 2 Type II | Planned for 2027 |
| ISO 27001 | Self-assessed; formal certification planned |
| EU Cloud Code of Conduct | Under evaluation |
| Common Criteria | Future consideration |
Contact
- Security issues: security@opencrowd.io
- General inquiries: info@opencrowd.io
- Documentation: https://opencrowd.io/docs
- Source code: https://github.com/opencrowd-io/opencrowd