Trust Center · Security
Security
How OpenSource Technologies secures the software we build, the infrastructure we operate, and the engagements we run. Specific controls scoped per engagement and reviewed under your contract's DPA.
Section 01
Our security commitments
OST builds and operates custom software for clients in regulated, high-trust contexts. Security is engineered into the platform from day one rather than bolted on at audit time.
Our commitments:
- Defense in depth: Layered security across infrastructure, application, and operational dimensions
- Least privilege: Access granted only to the people and systems that need it
- Auditability: Append-only audit logs for sensitive operations, retained per contract
- Continuous improvement: Security review on every major release, patch hygiene as standard
- Per-engagement scoping: Specific controls calibrated to your data, your regulators, your customers
Section 02
Infrastructure security
OST-operated infrastructure (and infrastructure we deploy on behalf of clients) follows current industry best practices.
- Cloud hosting: Major providers (AWS, others per engagement) with hardened configurations
- Network security: Private networking, firewalls, and managed access controls
- Encryption in transit: TLS 1.2+ for all client-facing and inter-service traffic
- Encryption at rest: AES-256 for stored data (databases, file storage, backups)
- Patch management: Operating system, runtime, and dependency patching on a defined cadence
- Backup and recovery: Continuous backup with disaster-recovery procedures, tested regularly
Section 03
Application security
The software OST builds incorporates security as an engineering practice, not just a deployment concern.
- Secure coding standards: OWASP-aligned practices, input validation, output encoding, parameterized queries
- Authentication: Strong authentication, MFA where the engagement requires, SSO integration on request
- Authorization: Role-based access control, least-privilege enforcement at the application layer
- Session management: Secure session handling, idle and absolute timeouts, secure cookies
- Dependency management: Tracked dependency inventories, vulnerability scanning, timely updates
- Secrets management: Application secrets stored in vaults, not in source control or environment files
Section 04
Operational security
How OST operates the software and infrastructure on a day-to-day basis.
- Access control: Engineer access scoped to the engagements they work on, audited regularly
- Change management: Code review, automated testing, controlled deploys
- Logging and monitoring: Centralized logs, anomaly detection, alert routing for security events
- Vulnerability management: Regular scans of OST-operated systems, defined remediation timelines
- Personnel security: Background checks where contractually required, security training for engineering staff
- Vendor management: Subprocessors evaluated for security posture; see Sub-processors list
Section 05
Compliance frameworks we support
OST does not currently hold SOC 2 or ISO 27001 certification. We engineer toward those frameworks where engagements require, and we support clients in formalizing their own certifications.
Frameworks we have implemented for client engagements:
- HIPAA: HIPAA-aligned development for healthcare clients, on client-controlled HIPAA-eligible hosting. We sign a Business Associate Agreement when our work involves access to protected health information.
- PCI DSS: PCI DSS-aligned payment integrations using processor tokenization (for example Authorize.net Accept.js and hosted payment pages), so card data goes directly to the payment processor.
- WCAG 2.2 AA, Section 508 and ADA: Built and tested to WCAG 2.2 AA and Section 508, supporting ADA Title II and Title III obligations.
- GDPR + UK GDPR: EU and UK data subject rights, processing agreements, transfer mechanisms
- CCPA / CPRA + state privacy laws: Right-to-know, right-to-delete, opt-out
- Fair Housing Act: Fair Housing-aware design for real-estate platforms: accessible listings and non-discriminatory listing and advertising content.
For specific framework requirements on your engagement, contact form (Security disclosure or vulnerability report).
Section 06
Incident response
OST maintains an incident response process for security events affecting client engagements.
- Detection: Monitoring and alerting surface anomalies; clients can also report issues to contact form (Security disclosure or vulnerability report)
- Triage: Severity assessment, scope determination, initial containment
- Containment and remediation: Stop ongoing harm, remove the threat, restore normal operations
- Notification: Per contractual and legal obligations (typically 72 hours for confirmed breaches under most frameworks)
- Post-incident review: Root cause analysis, corrective action, documentation
Notification timelines, formats, and recipients are determined by the engagement contract, the data protection agreement, and applicable law (e.g., GDPR Article 33, state breach-notification statutes).
Section 07
Reporting a security issue
If you believe you have found a security vulnerability in ost.agency or in any platform OST builds or operates, please tell us.
How to report
What to include
- A description of the issue and its potential impact
- Steps to reproduce it, or a proof of concept
- The affected URL, platform or domain
- How we can reach you for follow-up questions
What to expect
- We reply within 5 business days.
- We keep you updated while we investigate and fix the issue.
- Please give us reasonable time to fix it before any public disclosure, and coordinate disclosure with OST and any affected client.
Rules for good-faith research
Good-faith security research is welcome. When testing, please:
- Do not run tests that could harm availability, such as denial-of-service, load or spam tests.
- Do not access, change or delete data that is not yours. If you reach someone else's data, stop and tell us.
- Do not use social engineering, phishing or physical attacks against OST staff, clients or offices.
Safe harbor
OST will not pursue legal action against researchers who act in good faith and follow this policy.