Security

OpenContact stores contact data and the credentials that reach your providers. This page lists what the application does today. It is based on the code, not on a certification.

Hosting

OpenContact is hosted by Hetzner in Germany.

Credentials

API keys, OAuth tokens and webhook secrets are encrypted at rest and never returned in browser or API responses. OAuth tokens are refreshed centrally before they expire.

Sign-in

• Passwords follow Laravel’s password rules and are hashed.
• Email verification is required before using the app.
• Optional two-factor authentication with an authenticator app (TOTP) and single-use recovery codes.
• Two-factor attempts are rate limited.

Access control

Contacts, connections, rules, API keys and webhooks belong to one project. Every sensitive action checks the member’s role.

• Admin: connections, billing, team, project settings, permanent contact erasure.
• Editor: contacts, lists, sources, rules, exports.
• Developer: API keys and outbound webhooks.

API keys are tied to one project and carry only the abilities you grant: contacts, lists, events, webhooks or keys. Sandbox keys never sync to real providers.

Inbound requests

• Generated high-entropy webhook tokens per source.
• Provider signatures checked where the provider offers them.
• Request size limits, replay windows and duplicate-event handling.
• Rate limits on webhook, unsubscribe and two-factor endpoints.
• Google Ads leads must carry the configured verification key.

Outbound requests

Webhook URLs must be public HTTPS. Private and reserved IP addresses are rejected, and DNS is checked again at delivery so a hostname cannot be rebound to an internal address. Deliveries are signed with HMAC-SHA256 over the timestamp and body.

Audit and traceability

Configuration changes are written to an audit log. Contact status changes, suppression events and sync operations appear in activity and on each contact’s timeline. Webhook deliveries show recent status and response codes.

Retention

Default retention, configurable per deployment:

Privacy requests

Admins can erase a contact permanently. OpenContact deletes the local record and sends an erasure request to each email provider the contact was synced to. Failed requests retry, and every request is recorded. Admins and editors can export everything held on a contact.

Not yet confirmed

We will add these only once verified. We make no certification claim.

• TLS policy
• backups and recovery
• incident response
• penetration testing
• SOC 2, ISO 27001 or other certifications

Report a vulnerability to [email protected].