Trust
Security
Last reviewed
OpenPlanr combines managed identity, server-side authorization, scoped sharing, isolated deployment environments, and tested release gates. This page explains those practices and where customer responsibility begins.
Scope and shared responsibility
This page describes the practices used for the OpenPlanr website, hosted company application, APIs, and hosted sharing services. The open-source CLI and local tools run in environments controlled by the person or organization operating them.
OpenPlanr protects the services it operates. Customers remain responsible for securing their devices and connected providers, assigning appropriate organization and project roles, protecting exported content, and promptly removing access that is no longer needed.
Identity and access
- Clerk provides identity verification, Google and Microsoft sign-in, email verification codes, sessions, account recovery, and multi-factor authentication.
- Organization membership, project roles, and document-scoped guest grants are separate authorization boundaries. A guest invitation does not create organization membership.
- The company API validates the signed identity and current authorization for protected requests. Client-side state is not the authority for access decisions.
- Sensitive account and administration actions require recent identity verification. Organization administrators must also satisfy the configured multi-factor policy.
Data protection
- Hosted traffic uses HTTPS. Service credentials and signing secrets are held in provider-managed secret stores rather than committed to source control.
- Cloudflare provides the hosted API, edge, database, object-storage, and isolated state services used by the company and sharing products. Vercel delivers the public website and company application.
- Guest invitation secrets are not stored in plaintext. A recipient must sign in with the matching verified email address before a scoped grant is created.
- Share links, exports, and locally generated artifacts must be treated according to the sensitivity of the content they contain.
Engineering and operations
Changes are reviewed and checked with automated type, unit, integration, browser, boundary, and build tests appropriate to the affected service. Preview and staging environments are kept distinct from production, and deployment targets are promoted independently.
Security-relevant activity is recorded with bounded operational metadata. Logs and audit records avoid plaintext invitation secrets and are retained according to their operational, security, and legal purpose.
Report a vulnerability
Send suspected vulnerabilities or security incidents to security@openplanr.dev. Include the affected service or URL, the observed behavior, reproduction steps, and the potential impact. Do not access another person's data, impair the service, or disclose a report publicly before we have had a reasonable opportunity to investigate it.
General account and product support belongs at support@openplanr.dev.
Assurance and service providers
Our Subprocessors page identifies the providers used for hosted identity, email, application delivery, and data services. Our Privacy Policy explains the information involved and the choices available to users.
This overview does not claim that OpenPlanr holds a certification or independent audit report. We describe a control as certified only when a current, applicable assessment supports that statement.