Openbox Trust Center
This page summarizes the current Openbox service in plain language. It separates implemented capabilities from focused production proof, workload-specific testing, independent assessment, and formal authorization.
We verify the requester, purpose, scope, authorization, and confidentiality terms before sharing non-public architecture, policy, recovery, incident, audit, or assessor material. Credentials, customer data, secret configuration, and unpublished findings are never included on this public page.
Last reviewed: August 13, 2026
The documented product or process exists and passed its recorded engineering checks.
A bounded path passed exact immutable production evidence; this is not universal coverage.
The internal workflow is ready for a governed customer-specific evaluation; customer acceptance is still required.
Only the named workload and test shape were measured.
Not currently claimed. This requires an approved external assessor and report.
Not currently claimed. This requires a decision by the applicable authority.
How Openbox protects access, separates organizations, and handles information.
Openbox uses authenticated sessions, server-side authorization, bounded administrative roles, protected release controls, dependency scanning, and security-focused engineering checks.
Current limitation: These are internal controls and focused production checks—not an independent penetration test, certification, or guarantee that no vulnerability exists.
Openbox limits collection to information needed for accounts, learning, workplace administration, support, billing, integrations, security, and the features an organization enables.
Current limitation: Privacy roles, retention, deletion, transfer, and location commitments depend on the customer, jurisdiction, providers, and signed agreement.
Account, workforce, course, learning, assessment, credential, audit, file, integration, and support records are handled through purpose-specific product and provider boundaries.
Current limitation: Customers remain responsible for lawful source data, correct roles, content rights, retention requirements, and avoiding unsupported sensitive HR or regulated data.
The production web service uses HTTPS. Managed providers and selected cloud storage protect stored data using their supported encryption controls, with secrets kept out of browser code and source control.
Current limitation: Exact keys, defensive configuration, provider evidence, and customer-specific encryption commitments are controlled evidence reviewed during procurement.
Organization context, server authorization, scoped service operations, and database row-level policies are designed to keep one organization from accessing another organization’s records.
Current limitation: Internal cross-tenant tests do not replace independent assessment or customer-specific integration and role validation.
Openbox currently uses commercial managed services, regional AWS resources in the United States, and global edge or delivery services where selected.
Current limitation: Openbox does not currently claim that all processing, support, logs, backups, or delivery stay in one region or entirely within the United States.
What is monitored, restored, and measured—and what has not yet been proven.
Health checks, exact-release verification, rollback capture, background-work controls, provider reconciliation, and incident procedures support service operation and recovery.
Current limitation: Monitoring coverage, staffing, provider dependencies, and contractual service commitments require customer and service-tier review.
A protected production-derived PostgreSQL backup restored 205 tables and 3,877 rows in an isolated environment in 44 minutes 7 seconds, including relationship and row-policy checks.
Current limitation: That exercise did not prove full authentication, object storage, every provider, regional failover, current-volume recovery, or a contractual RPO or RTO.
Openbox maintains engineering procedures for severity, escalation, containment, evidence preservation, recovery, privacy review, communications decisions, and post-incident follow-up.
Current limitation: Named staffing, contractual notification timing, legal decisions, and 24×7 response commitments are not established by the engineering runbook.
Openbox uses an initial non-contractual 99.9% public-availability engineering objective and verifies the exact public release during promotion.
Current limitation: No 99.9% contractual SLA, service-credit schedule, complete measurement history, or universal availability guarantee is currently approved.
One guarded staging canary exercised the documented recurring-assignment workflow for 10,000 synthetic learner records. A separate local harness validates capacity-test safety mechanics.
Current limitation: This is not evidence of 10,000 concurrent users, whole-platform capacity, a supported maximum tenant size, or a customer workload envelope.
Current product support, evaluation boundaries, and external work still required.
Openbox uses WCAG 2.2 Level AA as an engineering target and maintains automated checks, semantic UI patterns, keyboard support, responsive layouts, and a human review plan.
Current limitation: Full manual assistive-technology, content, document, mobile, zoom, and disabled-user review is pending. No approved ACR/VPAT or conformance claim is available.
Openbox has production-verified bounded profiles for SCORM 1.2, SCORM 2004 3rd/4th Edition, xAPI 1.0.3, and cmi5. Issued credentials have a hosted verification page and downloadable JSON data. SCIM 2.0 is a customer-specific pilot foundation; OpenAPI 3.1 and ICS support selected documented paths.
Current limitation: Tenant activation, exact package/profile support, customer integrations, and third-party compatibility require validation. Openbox does not claim universal standards conformance.
Openbox is a responsive web application and installable PWA designed for current managed desktop and mobile browsers. The blocking release path is Chromium-focused.
Current limitation: No contractual cross-browser, native-mobile, kiosk, or device-management support matrix is currently approved.
Openbox maintains internal architecture, security, accessibility, recovery, incident, privacy, supply-chain, release, and production evidence for controlled review.
Current limitation: Openbox is not currently claiming SOC 2, ISO 27001, FedRAMP, StateRAMP/GovRAMP, independent penetration-test completion, accessibility certification, or another formal authorization.
Openbox has a provisional commercial operating model designed for evaluation by regulated enterprises and state or local organizations.
Current limitation: Suitability depends on the named solicitation, data, impact level, accessibility, residency, security, support, contract, and authorization requirements. No government authorization is claimed.
These providers support the current service or an optional configured feature. Exact products, data categories, regions, support access, transfer terms, and contract status are confirmed for the customer’s selected service during review.
| Provider | Service purpose | Customer data | Location |
|---|---|---|---|
| Supabase | Sign-in and the main database | Account details and learning records: assignments, progress, scores, certificates, notes, and audit events | United States (Oregon) |
| Amazon Web Services | File storage, malware scanning, background processing, content delivery, and encrypted backups | Uploaded files and course content, scan results, encrypted backups, and operational logs | United States (Ohio); global delivery network |
| Vercel | Web hosting and server functions | Data in transit through the app, and request logs (IP address, browser, and page path) | United States (Oregon); global delivery network |
| Mux | Video hosting, playback, and captions | Course videos and captions, and playback quality data without learner identity | United States; may process globally |
| Resend | Email delivery | Recipient name and email, message content, and delivery status | United States |
| Cloudflare Turnstile | Bot protection on sign-in and public forms | Browser signals and IP address | Global network |
| Google sign-in | Name, email, and Google account ID | United States; may process globally | |
| Stripe | Payments for self-serve purchases | Billing contact and payment status; Openbox never stores full card numbers | United States; may process globally |
| Namecheap | Support email mailbox | Messages you send to Openbox support | United States |
| GitHub | Source code and release automation | No customer data by design | United States |
Customer data is stored in the United States: the database in Oregon, and files and backups in Ohio. Delivery networks and some providers may process data in other regions to deliver the service. We notify customers 30 days before adding a new subprocessor.
| Provider | Service purpose | Status | Customer data when on |
|---|---|---|---|
| WorkOS | Enterprise single sign-on (SAML and OIDC) | Off until a customer turns it on | Sign-in identity details from your identity provider |
| Google Calendar | Optional Pulse calendar import | Off until enabled | Titles and times of meetings a person chooses to import |
| Anthropic | AI course drafting | Planned | Only the material an administrator submits for drafting |
Identity, HRIS, webhook, embedded-content, or course package providers that a customer chooses add their own subprocessors and locations.
Review the public policy pages for additional detail. Contractual commitments apply only when they appear in an authorized signed agreement.