Openbox Trust Center
This page summarizes the current Openbox service in plain language. It separates implemented capabilities from focused production proof, workload-specific testing, independent assessment, and formal authorization.
Request controlled evidenceWe verify the requester, purpose, scope, authorization, and confidentiality terms before sharing non-public architecture, policy, recovery, incident, audit, or assessor material. Credentials, customer data, secret configuration, and unpublished findings are never included on this public page.
Last reviewed: August 13, 2026
The documented product or process exists and passed its recorded engineering checks.
A bounded path passed exact immutable production evidence; this is not universal coverage.
The internal workflow is ready for a governed customer-specific evaluation; customer acceptance is still required.
Only the named workload and test shape were measured.
Not currently claimed. This requires an approved external assessor and report.
Not currently claimed. This requires a decision by the applicable authority.
How Openbox protects access, separates organizations, and handles information.
Openbox uses authenticated sessions, server-side authorization, bounded administrative roles, protected release controls, dependency scanning, and security-focused engineering checks.
Current limitation: These are internal controls and focused production checks—not an independent penetration test, certification, or guarantee that no vulnerability exists.
Openbox limits collection to information needed for accounts, learning, workplace administration, support, billing, integrations, security, and the features an organization enables.
Current limitation: Privacy roles, retention, deletion, transfer, and location commitments depend on the customer, jurisdiction, providers, and signed agreement.
Account, workforce, course, learning, assessment, credential, audit, file, integration, and support records are handled through purpose-specific product and provider boundaries.
Current limitation: Customers remain responsible for lawful source data, correct roles, content rights, retention requirements, and avoiding unsupported sensitive HR or regulated data.
The production web service uses HTTPS. Managed providers and selected cloud storage protect stored data using their supported encryption controls, with secrets kept out of browser code and source control.
Current limitation: Exact keys, defensive configuration, provider evidence, and customer-specific encryption commitments are controlled evidence reviewed during procurement.
Organization context, server authorization, scoped service operations, and database row-level policies are designed to keep one organization from accessing another organization’s records.
Current limitation: Internal cross-tenant tests do not replace independent assessment or customer-specific integration and role validation.
Openbox currently uses commercial managed services, regional AWS resources in the United States, and global edge or delivery services where selected.
Current limitation: Openbox does not currently claim that all processing, support, logs, backups, or delivery stay in one region or entirely within the United States.
What is monitored, restored, and measured—and what has not yet been proven.
Health checks, exact-release verification, rollback capture, background-work controls, provider reconciliation, and incident procedures support service operation and recovery.
Current limitation: Monitoring coverage, staffing, provider dependencies, and contractual service commitments require customer and service-tier review.
A protected production-derived PostgreSQL backup restored 205 tables and 3,877 rows in an isolated environment in 44 minutes 7 seconds, including relationship and row-policy checks.
Current limitation: That exercise did not prove full authentication, object storage, every provider, regional failover, current-volume recovery, or a contractual RPO or RTO.
Openbox maintains engineering procedures for severity, escalation, containment, evidence preservation, recovery, privacy review, communications decisions, and post-incident follow-up.
Current limitation: Named staffing, contractual notification timing, legal decisions, and 24×7 response commitments are not established by the engineering runbook.
Openbox uses an initial non-contractual 99.9% public-availability engineering objective and verifies the exact public release during promotion.
Current limitation: No 99.9% contractual SLA, service-credit schedule, complete measurement history, or universal availability guarantee is currently approved.
One guarded staging canary exercised the documented recurring-assignment workflow for 10,000 synthetic learner records. A separate local harness validates capacity-test safety mechanics.
Current limitation: This is not evidence of 10,000 concurrent users, whole-platform capacity, a supported maximum tenant size, or a customer workload envelope.
Current product support, evaluation boundaries, and external work still required.
Openbox uses WCAG 2.2 Level AA as an engineering target and maintains automated checks, semantic UI patterns, keyboard support, responsive layouts, and a human review plan.
Current limitation: Full manual assistive-technology, content, document, mobile, zoom, and disabled-user review is pending. No approved ACR/VPAT or conformance claim is available.
Openbox has production-verified bounded profiles for SCORM 1.2, SCORM 2004 3rd/4th Edition, xAPI 1.0.3, cmi5, Open Badges 3.0, and CLR 2.0. SCIM 2.0 is a customer-specific pilot foundation; OpenAPI 3.1 and ICS support selected documented paths.
Current limitation: Tenant activation, exact package/profile support, customer integrations, and third-party compatibility require validation. Openbox does not claim universal standards conformance.
Openbox is a responsive web application and installable PWA designed for current managed desktop and mobile browsers. The blocking release path is Chromium-focused.
Current limitation: No contractual cross-browser, native-mobile, kiosk, device-management, or unrestricted offline-content support matrix is currently approved.
Openbox maintains internal architecture, security, accessibility, recovery, incident, privacy, supply-chain, release, and production evidence for controlled review.
Current limitation: Openbox is not currently claiming SOC 2, ISO 27001, FedRAMP, StateRAMP/GovRAMP, independent penetration-test completion, accessibility certification, or another formal authorization.
Openbox has a provisional commercial operating model designed for evaluation by regulated enterprises and state or local organizations.
Current limitation: Suitability depends on the named solicitation, data, impact level, accessibility, residency, security, support, contract, and authorization requirements. No government authorization is claimed.
These providers support the current service or an optional configured feature. Exact products, data categories, regions, support access, transfer terms, and contract status are confirmed for the customer’s selected service during review.
| Provider | Service purpose |
|---|---|
| Vercel | Web hosting, server execution, deployment, and operational logs |
| Supabase | Authentication, PostgreSQL database, and selected object storage |
| Amazon Web Services | Private objects, queues, workers, scanning, delivery, telemetry, and backups |
| Stripe | Checkout, subscriptions, billing portal, and payment reconciliation |
| Mux | Managed video upload, processing, playback, and captions when selected |
| Resend | Transactional email delivery and suppression events |
| Cloudflare Turnstile | Bot and abuse protection on selected public forms |
| Social sign-in; calendar import only after verification and explicit enablement | |
| GitHub | Source control, release automation, artifacts, and dependency evidence |
Customer-selected identity, HRIS, webhook, embedded-content, or package providers can add separate subprocessors and locations. Openbox does not make a U.S.-only or single-region processing claim.
Review the public policy pages for additional detail. Contractual commitments apply only when they appear in an authorized signed agreement.