Where we run
- Edge nodes in Germany and Spain, in the EU.
- DNS servers and customer data in Germany. Daily backups go to separate storage in the EU.
- Security events are deleted after 30 days.
The list of companies that process personal data for OpenWAF, with their locations, is on the Sub-processors (external link) page.
How the service is protected
- Signed configuration. Edge nodes only apply configuration documents signed with Ed25519 and reject anything that does not verify. If they cannot reach the control plane, they keep serving the last valid configuration.
- Change control. Every change is versioned, needs a reason and is audited. See Change control.
- Passwordless sign-in. Email codes or Google/GitHub; sessions expire. See Create an account.
- Tokens. API tokens are stored only as hashes, with a role, a scope and an expiry of at most 365 days. See API tokens.
- TLS everywhere. Hybrid post-quantum key exchange is preferred towards visitors and towards origins; new domains verify the origin certificate (Full strict). See SSL/TLS.
- Hidden DNS primary. Only the public secondary servers answer DNS queries.
The full, current list of controls and the state of our compliance programme (SOC 2 readiness, ISMS aligned with ISO/IEC 27001) are on the Security (external link) page. Early access has no SLA, no SOC 2 report and no ISO/IEC 27001 certificate yet.
Legal documents
| Document | Link |
|---|---|
| Terms of service | openwaf.dev/legal/terms (external link) |
| Acceptable use policy | openwaf.dev/legal/acceptable-use (external link) |
| Privacy policy | openwaf.dev/legal/privacy (external link) |
| Data processing agreement (DPA) | openwaf.dev/legal/dpa (external link) (PDF (external link)) |
| Sub-processors | openwaf.dev/legal/subprocessors (external link) |
| Cookies | openwaf.dev/legal/cookies (external link) |
| Legal notice | openwaf.dev/legal/notice (external link) |
You accept the terms, the acceptable use policy and the DPA when you create your organization. OpenWAF processes your clients' traffic on your behalf as a processor under the DPA.
Report a vulnerability
Email [email protected], in English or Spanish. The same contact is published in security.txt (external link). Include a description and its impact, the steps to reproduce it with the affected host names or URLs, and how we can contact you. Read the disclosure guidelines (external link) first: test only what you own or are authorised to test, and no denial-of-service or heavy scanning.
Other contacts
| Topic | Contact |
|---|---|
| Support, account help, privacy and DPA questions | [email protected] |
| Phishing, malware or other abuse on a site behind OpenWAF | [email protected] |
| Vulnerabilities and security reviews | [email protected] |
Automatic emails, such as sign-in codes, come from [email protected], which does not receive replies.